What’s Vulnerable › Vulnerabilities
CVE-2004-0200
- Severity: critical (CVSS 9.3 v2.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 49.0% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2004-09-28 · updated 2026-06-16
Description
Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation.
Affected products
- Microsoft .NET Framework: 1.0-sp2
- Microsoft Digital Image Pro: 7.0, 9
- Microsoft Digital Image Suite: 9
- Microsoft Excel 2013 Service Pack 1: 2002, 2003
- Microsoft Frontpage: 2002, 2003
- Microsoft Greetings: 2002
- Microsoft Infopath: 2003
- Microsoft Office: 2003, xp-sp3
- Microsoft OneNote for Android: 2003
- Microsoft Outlook: 2002, 2003
- Microsoft Picture It: 7.0, 9, 2002
- Microsoft PowerPoint for Android: 2002, 2003
- Microsoft Producer: all versions
- Microsoft Project: 2002-sp1, 2003
- Microsoft Publisher: 2002, 2003
- Microsoft Visio: 2002-sp2, 2003
- Microsoft Visual Basic: 2002, 2003
- Microsoft Visual C#: 2002, 2003
- Microsoft Visual C++: 2002, 2003
- Microsoft Visual J# .Net: 2003
- Microsoft Visual Studio .Net: 2002-gold, 2003-gold
- Microsoft Windows 2003 Server: r2
- Microsoft Windows XP Service Pack 3: all versions
- Microsoft Word for Android: 2002, 2003
References
- http://marc.info/?l=bugtraq&m=109524346729948&w=2
- http://www.kb.cert.org/vuls/id/297462
- http://www.us-cert.gov/cas/techalerts/TA04-260A.html
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-028
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16304
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1105
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1721
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2706
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3038
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3082
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3320
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3810
Get alerted when CVE-2004-0200 or the next vulnerability affects your stack