Vulnerability record · CVE-2004-0420 · published 7 July 2004
CVE-2004-0420: Windows Shell CLSID filename spoofing allows remote code execution
Microsoft · Ie
The Windows Shell trusts a CLSID specifier embedded in a filename, letting a remote attacker spoof the file type and cause arbitrary code execution. It affects Windows 98, ME, NT 4.0, 2000, XP and Server 2003, and was demonstrated through Internet Explorer 6.0.2800.1106 on Windows XP. Because the flaw is reachable from the network with no authentication, it is a serious code execution issue for unpatched systems.
Description
The Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by spoofing the type of a file via a CLSID specifier in the filename, as demonstrated using Internet Explorer 6.0.2800.1106 on Windows XP.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
critical priorityNetwork-reachable, unauthenticated code execution with complete impact and public exploit references, though only on legacy Windows versions.
What it is
The Windows Shell trusts a CLSID specifier embedded in a filename, letting a remote attacker spoof the file type and cause arbitrary code execution. It affects Windows 98, ME, NT 4.0, 2000, XP and Server 2003, and was demonstrated through Internet Explorer 6.0.2800.1106 on Windows XP. Because the flaw is reachable from the network with no authentication, it is a serious code execution issue for unpatched systems.
Impact
An attacker can execute arbitrary code with the privileges of the user who opens or processes the crafted file, giving full control of the affected host. The CVSS 2.0 vector rates confidentiality, integrity and availability impact as complete.
Attack surface
Reachable over the network (AV:N) with low complexity and no authentication (AC:L/Au:N), typically by delivering a crafted filename or link that the Windows Shell or Internet Explorer processes. User interaction is implied by the demonstration via Internet Explorer, though the record does not state it explicitly.
Exploitation
Not listed in CISA KEV, but EPSS is high at 0.46012 (98.75th percentile) and multiple references carry an Exploit tag, indicating public exploit material exists.
What to do
- Apply Microsoft security bulletin MS04-024 for affected Windows versions.
- Upgrade or retire unsupported platforms (Windows 98, ME, NT 4.0) that cannot receive the fix.
- Block or filter untrusted file attachments and links at email and web gateways.
- Restrict Internet Explorer use and enforce attachment handling policies on remaining legacy hosts.
Detection
- Monitor process creation for shell or browser processes spawning unexpected child processes after file or link handling.
- Alert on files or URLs containing CLSID-style specifiers in filenames reaching endpoints.
- Review legacy Windows hosts for missing MS04-024 patch status via vulnerability scanning.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2004-0420 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2004-0420), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
