$ cve CVE-2003-0818 JSON

CVE-2003-0818 EXPLOIT

7.5

HIGH · CVSS 2.0 · EPSS 82.2% (pctl 100)

Patch early

A public exploit exists.

Description

Multiple integer overflows in Microsoft ASN.1 library (MSASN1.DLL), as used in LSASS.EXE, CRYPT32.DLL, and other Microsoft executables and libraries on Windows NT 4.0, 2000, and XP, allow remote attackers to execute arbitrary code via ASN.1 BER encodings with (1) very large length fields that cause arbitrary heap data to be overwritten, or (2) modified bit strings.

Scoring

CVSS	7.5 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS	82.24% — more likely to be exploited than 100% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2004-03-03
Last modified	2026-06-16

Affected (4)

Vendor	Product
microsoft	windows 2000
microsoft	windows 2003 server
microsoft	windows nt
microsoft	windows xp

Public exploits

Source	Title	Date
exploit-db	Microsoft Windows - ASN.1 Library Bitstring Heap Overflow (MS04-007) (Metasploit)	2010-07-25
exploit-db	Microsoft Windows - ASN.1 Remote (MS04-007)	2004-03-26
exploit-db	Microsoft Windows - ASN.1 'LSASS.exe' Remote Denial of Service (MS04-007)	2004-02-14

References

→ the Explorer · watch your stack · NVD