Vulnerability record · CVE-2003-0352 · published 18 August 2003
CVE-2003-0352: Microsoft Windows RPC DCOM Interface Buffer Overflow
Microsoft · Windows 2000
A buffer overflow in a DCOM interface for RPC in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows a remote attacker to execute arbitrary code via a malformed message. This is the vulnerability exploited by the Blaster/MSblast/LovSAN and Nachi/Welchia worms, making it a high-impact, remotely reachable flaw in unpatched systems.
Description
Buffer overflow in a certain DCOM interface for RPC in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary code via a malformed message, as exploited by the Blaster/MSblast/LovSAN and Nachi/Welchia worms.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
critical priorityThe flaw is remotely exploitable without authentication, has confirmed worm exploitation, and carries an EPSS probability of 0.98484, making it an urgent risk for any unpatched legacy Windows system.
What it is
A buffer overflow in a DCOM interface for RPC in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows a remote attacker to execute arbitrary code via a malformed message. This is the vulnerability exploited by the Blaster/MSblast/LovSAN and Nachi/Welchia worms, making it a high-impact, remotely reachable flaw in unpatched systems.
Impact
A remote attacker can execute arbitrary code with the privileges of the vulnerable RPC service, typically SYSTEM, leading to full host compromise. The flaw was weaponized by self-propagating worms that caused widespread disruption.
Attack surface
The vulnerability is reachable over the network via RPC/DCOM on TCP port 135 (and related RPC ports); no authentication or user interaction is required per the AV:N/AC:L/Au:N vector. Any host exposing the affected RPC interface is a target.
Exploitation
Exploitation is confirmed by the description and reference tags indicating exploit availability and worm activity; EPSS is 0.98484 (99.9th percentile), though CISA KEV does not list it. The record does not include a KEV entry, but the historical worm exploitation is explicit.
What to do
- Apply Microsoft security bulletin MS03-026 (patch) immediately to all affected Windows NT 4.0, 2000, XP, and Server 2003 systems.
- Block TCP port 135 and other RPC/DCOM ports at network boundaries and between untrusted network segments.
- Disable or restrict unnecessary DCOM/RPC services and interfaces where operationally feasible.
- Segment networks to limit lateral movement and worm propagation from compromised hosts.
- Monitor for and isolate unpatched legacy systems that cannot be updated.
Detection
- Monitor network traffic for malformed or anomalous RPC/DCOM requests to TCP port 135 and related RPC ports.
- Alert on known Blaster/Welchia worm indicators, such as specific payload strings or scanning behavior on port 135.
- Audit host logs for unexpected service crashes or RPC service restarts that may indicate exploitation attempts.
- Use IDS/IPS signatures for CVE-2003-0352 and associated worm traffic.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2003-0352 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2003-0352), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
