Skip to content
Back to search

CVE-2004-0574

HIGH
10.0NVD

Summary

generated automatically from NVD data

The NNTP component in Microsoft Windows NT Server 4.0, Windows 2000 Server, Windows Server 2003, Exchange 2000 Server, and Exchange Server 2003 mishandles XPAT patterns. The flaw is possibly tied to improper length validation (an "unchecked buffer") and causes off-by-one and heap-based buffer overflows (CWE-787). A remote attacker could exploit it to execute arbitrary code, and the issue is rated CVSS v2.0 10.0 (HIGH).

NVD description

The Network News Transfer Protocol (NNTP) component of Microsoft Windows NT Server 4.0, Windows 2000 Server, Windows Server 2003, Exchange 2000 Server, and Exchange Server 2003 allows remote attackers to execute arbitrary code via XPAT patterns, possibly related to improper length validation and an "unchecked buffer," leading to off-by-one and heap-based buffer overflows.

Share:

EPSS · FIRST.org

67.8%probability of exploitation in the next 30 days

Higher than 99% of scored CVEs

EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-29, recomputed daily by FIRST.org.

CVSS v2.0 Score

10.0
/ 10.0
HIGH
AV:N/AC:L/Au:N/C:C/I:C/A:C

Information

Published
3 nov. 2004
Updated
16 juin 2026
Status
Modified
Source
cve@mitre.org

Affected products

microsoft exchange server
Versions 2000 · 2003
microsoft windows 2000
microsoft windows nt
Versions 4.0
microsoft windows server 2003
Versions r2

Bounds published by NVD: "< 8.4.27" means 8.4.27 is no longer vulnerable. The fixed release to install is in the vendor advisory.

Weaknesses (CWE)

CWE-787

References (24)

Similar CVEs

Other vulnerabilities of type CWE-787

…

Know which CVEs hit the versions you run.

Add the product and its version: cveo.tech lists the CVEs that affect it right away, then alerts you by email when a new one affects it — including before NVD has finished its analysis. Free, an account is all it takes.

Add my first deviceI already have an account