What’s Vulnerable › Vulnerabilities

CVE-2004-1306

• Severity: medium (CVSS 5.1 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 19.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2004-12-31 · updated 2026-06-16

Description

Heap-based buffer overflow in winhlp32.exe in Windows NT, Windows 2000 through SP4, Windows XP through SP2, and Windows 2003 allows remote attackers to execute arbitrary code via a crafted .hlp file.

Affected products

• Microsoft Windows 2000: all versions
• Microsoft Windows 2003 Server: datacenter_64-bit-sp1_beta_1, enterprise, enterprise-sp1_beta_1, enterprise_64-bit, enterprise_64-bit-sp1_beta_1, r2 (+5)
• Microsoft Windows Nt: 4.0, 4.0-sp1, 4.0-sp2, 4.0-sp3, 4.0-sp4, 4.0-sp5 (+2)
• Microsoft Windows XP Service Pack 3: all versions

References

• http://marc.info/?l=bugtraq&m=110383690219440&w=2
• http://www.securityfocus.com/bid/12092
• http://www.xfocus.net/flashsky/icoExp/
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18678
• http://marc.info/?l=bugtraq&m=110383690219440&w=2
• http://www.securityfocus.com/bid/12092
• http://www.xfocus.net/flashsky/icoExp/
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18678

Get alerted when CVE-2004-1306 or the next vulnerability affects your stack