CVE-2004-0209: Windows Graphics Rendering Engine buffer overflow via WMF/EMF images

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS v2 10.0 with network reachability, no authentication and complete impact, plus a high EPSS score, makes this a top remediation priority despite the absence of a KEV listing.

What it is

The Graphics Rendering Engine in Windows 2000, XP and Server 2003 contains an unchecked buffer when processing WMF or EMF image formats. A remote attacker can trigger a buffer overflow by supplying a crafted metafile, which the record states leads to arbitrary code execution. The flaw is rated CVSS v2 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C), so it is remotely reachable with no authentication and full impact if exploited.

Impact

Successful exploitation gives the attacker arbitrary code execution in the context of the process that renders the image, which on these Windows versions can mean full system compromise. The record does not specify the exact privilege level, but the CVSS impact subscore is complete for confidentiality, integrity and availability.

Attack surface

Reached over the network by delivering a malicious WMF or EMF file to a system or application that renders metafiles; the vector is AV:N/AC:L/Au:N, so no authentication is required. The description does not state whether user interaction (for example opening an image) is needed, so that detail is missing.

Exploitation

CISA KEV does not list this CVE, but EPSS is high at 0.57383 (99th percentile), indicating a meaningful probability of exploitation activity. No reference is tagged as an exploit or proof-of-concept, so the record does not confirm public exploit code.

What to do

• Apply Microsoft security bulletin MS04-032 (the vendor fix referenced in the record) to Windows 2000, XP and Server 2003 systems.
• If patching cannot be done immediately, restrict or block untrusted WMF/EMF files at mail gateways, web proxies and file shares.
• Disable or harden components that automatically render metafiles (for example preview handlers and thumbnail generation) where the platform allows it.
• Isolate legacy Windows 2000/XP/2003 hosts that cannot be patched and limit their network exposure.
• Monitor vendor guidance for any updated advisory, since the NVD record is marked Modified.

Detection

• Hunt for processes that render images (explorer.exe, iexplore.exe, imaging components) spawning unexpected child processes or making unusual network connections.
• Monitor for WMF/EMF files arriving from external sources and for writes of such files to temporary or preview directories.
• Use EDR or Windows event telemetry to flag crashes or buffer-overflow indicators in graphics rendering processes on the affected OS versions.
• Check host inventory for unpatched Windows 2000, XP and Server 2003 systems and correlate with MS04-032 installation status.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.