Vulnerability record · CVE-2003-0717 · published 17 November 2003
CVE-2003-0717: Windows Messenger Service buffer overflow allows remote code execution
Microsoft · Windows 2000
The Windows Messenger Service on Windows NT through Server 2003 fails to verify the length of an incoming message, causing a buffer overflow. A remote, unauthenticated attacker can send a crafted message to the service and execute arbitrary code with system privileges. The flaw affects a broad set of legacy Windows versions and is trivially reachable over the network.
Description
The Messenger Service for Windows NT through Server 2003 does not properly verify the length of the message, which allows remote attackers to execute arbitrary code via a buffer overflow attack.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
critical priorityUnauthenticated remote code execution with a high EPSS score and a public exploit reference makes this a top-priority patching and exposure-reduction item despite the age of the affected platforms.
What it is
The Windows Messenger Service on Windows NT through Server 2003 fails to verify the length of an incoming message, causing a buffer overflow. A remote, unauthenticated attacker can send a crafted message to the service and execute arbitrary code with system privileges. The flaw affects a broad set of legacy Windows versions and is trivially reachable over the network.
Impact
An attacker gains remote code execution on the target host, typically with SYSTEM-level privileges, allowing full compromise of the machine. No user interaction or prior authentication is required.
Attack surface
Reached over the network via the Messenger Service, which listens on UDP ports 135, 137, 138 and 139; the CVSS vector AV:N/AC:L/Au:N confirms no authentication and no user interaction are needed. Any host with the Messenger Service enabled and reachable is exposed.
Exploitation
The record is not listed in CISA KEV, but EPSS is 0.60995 (99.1st percentile), indicating high predicted exploitation activity, and a SecurityFocus reference is tagged Exploit. No ransomware association is documented.
What to do
- Apply Microsoft security bulletin MS03-043 to patch the Messenger Service buffer overflow.
- Disable the Messenger Service on all hosts where it is not required.
- Block inbound NetBIOS and SMB-related ports (135, 137, 138, 139) at network boundaries.
- Retire or isolate unsupported Windows NT, 2000, ME, XP and Server 2003 systems that cannot be patched.
- Restrict network access to legacy hosts using host-based firewalls or segmentation.
Detection
- Monitor for unexpected Messenger Service pop-up traffic or anomalous UDP packets to ports 135-139.
- Alert on crashes or restarts of the Messenger Service (svchost.exe hosting messenger) on legacy hosts.
- Hunt for suspicious processes spawned by the Messenger Service or unusual child processes from svchost.exe.
- Review network flow logs for inbound connections to legacy Windows hosts on NetBIOS/SMB ports from untrusted sources.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
5 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2003-0717 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2003-0717), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
