Vulnerability record · CVE-2003-0812 · published 15 December 2003
CVE-2003-0812: Windows Workstation Service RPC logging buffer overflow
Microsoft · Windows 2000
The Windows Workstation Service (WKSSVC.DLL) contains a stack-based buffer overflow in a logging function. Long entries written to the NetSetup.LOG debug log via RPC calls, such as the NetAddAlternateComputerName API, can overflow the stack. This matters because it is remotely reachable over RPC and can lead to arbitrary code execution.
Description
Stack-based buffer overflow in a logging function for Windows Workstation Service (WKSSVC.DLL) allows remote attackers to execute arbitrary code via RPC calls that cause long entries to be written to a debug log file ("NetSetup.LOG"), as demonstrated using the NetAddAlternateComputerName API.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityRemote unauthenticated code execution with a very high EPSS score and public exploit references, though not in CISA KEV.
What it is
The Windows Workstation Service (WKSSVC.DLL) contains a stack-based buffer overflow in a logging function. Long entries written to the NetSetup.LOG debug log via RPC calls, such as the NetAddAlternateComputerName API, can overflow the stack. This matters because it is remotely reachable over RPC and can lead to arbitrary code execution.
Impact
A remote attacker can execute arbitrary code in the context of the vulnerable service, potentially gaining system-level control. This can lead to full compromise of the affected host.
Attack surface
The flaw is reached over the network via RPC calls to the Windows Workstation Service. The CVSS vector AV:N/AC:L/Au:N indicates no authentication is required and no user interaction is needed.
Exploitation
The record is not listed in CISA KEV, but EPSS is very high (0.81046, 99.6th percentile) and a reference is tagged Exploit, indicating public exploit activity is likely.
What to do
- Apply the Microsoft security update MS03-049 for affected Windows 2000 and Windows XP systems.
- Block or restrict RPC traffic to the Workstation Service from untrusted networks using host firewalls or network segmentation.
- Disable the Workstation Service where it is not required for business operations.
- Monitor vendor and CERT/CC advisories for updated guidance and patches.
Detection
- Monitor for unexpected RPC calls to the Workstation Service, especially those invoking NetAddAlternateComputerName or similar APIs.
- Check for unusual or oversized entries in NetSetup.LOG on affected hosts.
- Look for service crashes or unexpected restarts of the Workstation Service that could indicate exploitation attempts.
- Use network monitoring to detect anomalous RPC traffic to ports associated with the Workstation Service.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2003-0812 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2003-0812), CISA KEV, FIRST EPSS (scores of 2026-09-25). This page is refreshed as NVD updates the record.
