Vulnerability record · CVE-2004-0212 · published 6 August 2004
CVE-2004-0212: Windows Task Scheduler .job file stack buffer overflow
Avaya · Ip600 Media Servers
The Windows Task Scheduler in Windows 2000 and XP, and Internet Explorer 6 on Windows NT 4.0, contains a stack-based buffer overflow triggered by a .job file containing long parameters. Successful exploitation allows arbitrary code execution, and the flaw can be reached both locally and remotely, making it a serious risk on unpatched legacy systems.
Description
Stack-based buffer overflow in the Task Scheduler for Windows 2000 and XP, and Internet Explorer 6 on Windows NT 4.0, allows local or remote attackers to execute arbitrary code via a .job file containing long parameters, as demonstrated using Internet Explorer and accessing a .job file on an anonymous share.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
critical priorityCVSS 2.0 base score of 10 with network-reachable, unauthenticated code execution and a very high EPSS percentile, despite the age of the affected platforms.
What it is
The Windows Task Scheduler in Windows 2000 and XP, and Internet Explorer 6 on Windows NT 4.0, contains a stack-based buffer overflow triggered by a .job file containing long parameters. Successful exploitation allows arbitrary code execution, and the flaw can be reached both locally and remotely, making it a serious risk on unpatched legacy systems.
Impact
An attacker can execute arbitrary code with the privileges of the affected process, potentially gaining full control of the host. The CVSS 2.0 vector rates confidentiality, integrity and availability impact as complete.
Attack surface
Reachable over the network without authentication (AV:N/AC:L/Au:N), for example by luring a user to open a malicious .job file through Internet Explorer or by accessing a .job file on an anonymous share. No credentials are required, though remote delivery via IE may depend on user interaction.
Exploitation
Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is high at 0.635 (99.2nd percentile), indicating substantial predicted exploitation activity. Reference tags include a Patch advisory from US-CERT and a US Government Resource, with no public exploit tag present in the record.
What to do
- Apply Microsoft security bulletin MS04-022 (patch) to all affected Windows 2000, XP and NT 4.0 systems.
- Remove or restrict anonymous share access so .job files cannot be retrieved without authentication.
- Block or filter .job file delivery and execution at email gateways, web proxies and endpoint controls.
- Retire or isolate unsupported Windows NT 4.0 and legacy Windows 2000/XP hosts that cannot be patched.
- Restrict Task Scheduler service exposure and limit interactive browsing to trusted sites on affected IE 6 installations.
Detection
- Monitor for creation or execution of .job files, especially from network shares, email attachments or browser download directories.
- Alert on Task Scheduler process crashes or unexpected child processes spawned by the scheduler service.
- Review file share and web proxy logs for anonymous access to .job files and for IE-initiated retrieval of such files.
- Use the OVAL definitions referenced for this CVE to scan for unpatched Windows 2000, XP and NT 4.0 hosts.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
8 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2004-0212 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2004-0212), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
