CVE-2004-1049

An attacker crafts a malicious .bmp, .cur, .ico, or .ani file with a large image size field. When a user visits a malicious website or views a crafted email message, the file is processed by the LoadImage API, triggering an integer overflow that leads to a buffer overflow [ref_id=1]. The attacker can then execute arbitrary code with the privileges of the local user. User interaction is required — the attacker must persuade the victim to click a link or open the message [ref_id=1].

The vulnerability resides in the LoadImage API of the USER32 library on affected Windows versions. The advisory does not specify exact function names or file paths beyond "LoadImage API of the USER32 Lib" [ref_id=1].

Microsoft released security update MS05-002 to address this vulnerability [ref_id=1]. The update corrects the integer overflow in the LoadImage API by adding proper validation of image size fields before memory allocation, preventing the buffer overflow. The advisory recommends all affected customers apply the update immediately [ref_id=1]. No patch diff is available in the bundle.

A public PoC is referenced at http://www.xfocus.net/flashsky/icoExp/index.html, but the bundle does not include its contents. No reproduction steps are available in the provided reference write-ups.