Vulnerability record · CVE-2003-0818 · published 3 March 2004
CVE-2003-0818: Microsoft ASN.1 library integer overflows allow remote code execution
Microsoft · Windows 2000
The Microsoft ASN.1 library (MSASN1.DLL), used by LSASS.EXE, CRYPT32.DLL and other Windows components, contains multiple integer overflows triggered by malformed ASN.1 BER encodings with very large length fields or modified bit strings. Successful exploitation can overwrite arbitrary heap data and execute code in the context of the affected process. The flaw affects Windows NT 4.0, 2000, XP and 2003 Server.
Description
Multiple integer overflows in Microsoft ASN.1 library (MSASN1.DLL), as used in LSASS.EXE, CRYPT32.DLL, and other Microsoft executables and libraries on Windows NT 4.0, 2000, and XP, allow remote attackers to execute arbitrary code via ASN.1 BER encodings with (1) very large length fields that cause arbitrary heap data to be overwritten, or (2) modified bit strings.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityRemote, unauthenticated code execution in a core Windows component with a very high EPSS score, though no KEV listing or confirmed in-the-wild exploitation is recorded.
What it is
The Microsoft ASN.1 library (MSASN1.DLL), used by LSASS.EXE, CRYPT32.DLL and other Windows components, contains multiple integer overflows triggered by malformed ASN.1 BER encodings with very large length fields or modified bit strings. Successful exploitation can overwrite arbitrary heap data and execute code in the context of the affected process. The flaw affects Windows NT 4.0, 2000, XP and 2003 Server.
Impact
A remote attacker can execute arbitrary code with the privileges of the vulnerable service or process, potentially gaining full control of the host. Because LSASS is reachable over the network, this can lead to system compromise without prior authentication.
Attack surface
Reached over the network via ASN.1 BER data processed by affected Windows components such as LSASS; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required. Any service or application that parses attacker-supplied ASN.1 data is a potential entry point.
Exploitation
The record is not listed in CISA KEV and no reference is tagged as exploit code, but EPSS is very high (0.82241, 99.6th percentile), indicating strong likelihood of exploitation activity. No ransomware group is documented as using it.
What to do
- Apply Microsoft security bulletin MS04-007 (patch) to all affected Windows NT 4.0, 2000, XP and 2003 Server systems.
- Restrict network access to services that parse ASN.1 data, especially LSASS-related ports, using host and network firewalls.
- Disable or remove unnecessary services and applications that rely on MSASN1.DLL where feasible.
- Monitor vendor and CERT/CC advisories for updated guidance and verify patch deployment with the referenced OVAL definitions.
Detection
- Monitor for crashes or abnormal restarts of LSASS.EXE and other processes that load MSASN1.DLL.
- Inspect network traffic for malformed or unusually large ASN.1 BER length fields and modified bit strings.
- Correlate host logs for unexpected process creation or privilege escalation originating from LSASS or CRYPT32-related services.
- Use the OVAL definitions referenced in the record to audit patch state across affected hosts.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2003-0818 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2003-0818), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
