CVE-2004-0200
UnknownEPSS 49.02%
Last modified
CVE-2004-0200 is a vulnerability of currently unknown severity. Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation.. EPSS estimates a 49.02% chance of exploitation in the next 30 days.
Description
Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation.
Metrics
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Microsoft | .Net Framework | 1.0 | Sp2 |
| Microsoft | Digital Image Pro | 7.0 | — |
| Microsoft | Digital Image Pro | 9 | — |
| Microsoft | Digital Image Suite | 9 | — |
| Microsoft | Excel | 2002 | — |
| Microsoft | Excel | 2003 | — |
| Microsoft | Frontpage | 2002 | — |
| Microsoft | Frontpage | 2003 | — |
| Microsoft | Greetings | 2002 | — |
| Microsoft | Infopath | 2003 | — |
| Microsoft | Office | 2003 | — |
| Microsoft | Office | xp | Sp3 |
| Microsoft | Onenote | 2003 | — |
| Microsoft | Outlook | 2002 | — |
| Microsoft | Outlook | 2003 | — |
| Microsoft | Picture It | 7.0 | — |
| Microsoft | Picture It | 9 | — |
| Microsoft | Picture It | 2002 | — |
| Microsoft | Powerpoint | 2002 | — |
| Microsoft | Powerpoint | 2003 | — |
| Microsoft | Producer | All versions | Gold |
| Microsoft | Project | 2002 | Sp1 |
| Microsoft | Project | 2003 | — |
| Microsoft | Publisher | 2002 | — |
| Microsoft | Publisher | 2003 | — |
| Microsoft | Visio | 2002 | Sp2 |
| Microsoft | Visio | 2003 | — |
| Microsoft | Visual Basic | 2002 | — |
| Microsoft | Visual Basic | 2003 | — |
| Microsoft | Visual C\# | 2002 | — |
| Microsoft | Visual C\# | 2003 | — |
| Microsoft | Visual C\+\+ | 2002 | — |
| Microsoft | Visual C\+\+ | 2003 | — |
| Microsoft | Visual J\# .Net | 2003 | — |
| Microsoft | Visual Studio .Net | 2002 | Gold |
| Microsoft | Visual Studio .Net | 2003 | Gold |
| Microsoft | Word | 2002 | — |
| Microsoft | Word | 2003 | — |
| Microsoft | Windows 2003 Server | r2 | — |
| Microsoft | Windows Xp | All versions | — |
References
- http://www.kb.cert.org/vuls/id/297462US Government Resource
- http://www.us-cert.gov/cas/techalerts/TA04-260A.htmlUS Government Resource
- http://www.kb.cert.org/vuls/id/297462US Government Resource
- http://www.us-cert.gov/cas/techalerts/TA04-260A.htmlUS Government Resource
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2004-0200?
Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation.
How severe is CVE-2004-0200?
Severity scoring for CVE-2004-0200 is pending analysis. The EPSS model estimates a 49.02% probability of exploitation in the next 30 days.
How do I fix CVE-2004-0200?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2004
- CVE-2004-0191Mozilla before 1.4.2 executes Javascript events in the conte…
- CVE-2004-0192Cross-site scripting (XSS) vulnerability in the Management S…
- CVE-2004-0193Heap-based buffer overflow in the ISS Protocol Analysis Modu…
- CVE-2004-0194Stack-based buffer overflow in the OutputDebugString functio…
- CVE-2004-0197Buffer overflow in Microsoft Jet Database Engine 4.0 allows …
- CVE-2004-0199Help and Support Center in Microsoft Windows XP and Windows …
- CVE-2004-0201Heap-based buffer overflow in the HtmlHelp program (hh.exe) …
- CVE-2004-0202IDirectPlay4 Application Programming Interface (API) of Micr…
- CVE-2004-0203Cross-site scripting (XSS) vulnerability in Outlook Web Acce…
- CVE-2004-0204Directory traversal vulnerability in the web viewers for Bus…
- CVE-2004-0205Buffer overflow in Microsoft Internet Information Server (II…
- CVE-2004-0206Network Dynamic Data Exchange (NetDDE) services for Microsof…
Are you affected by CVE-2004-0200?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST