CVE-2003-0906

Vulnerability

A heap-based buffer overflow exists in the rendering code for Windows Metafile (WMF) and Enhanced Metafile (EMF) image formats in Microsoft Windows NT 4.0 Service Pack 6a, Windows 2000 Service Pack 2 through Service Pack 4, and Windows XP Service Pack 1 [1][2]. The vulnerability occurs when the system processes a specially crafted WMF or EMF file, allowing corruption of heap memory.

Exploitation

An attacker must convince a user to open a malicious WMF or EMF file, either by hosting it on a website and enticing the user to view it via a browser, or by sending it as an email attachment [1][2]. No authentication is required beyond user interaction. The attacker does not need a specific network position; any vector that delivers the image to the vulnerable rendering function can succeed.

Impact

Successful exploitation grants the attacker arbitrary code execution on the target system with the same privileges as the logged-on user [1][2]. This can lead to full compromise of the affected machine, including installation of programs, viewing, changing, or deleting data, and creating new accounts with full user rights.

Mitigation

Microsoft released security update MS04-011 on April 13, 2004, which addresses the vulnerability for all affected platforms [1]. Users should apply the update immediately. No workarounds are documented, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.