Vulnerability record · CVE-2004-0575 · published 3 November 2004
CVE-2004-0575: Windows DUNZIP32.DLL integer overflow in compressed folders
Microsoft · Windows 2003 Server
DUNZIP32.DLL on Windows XP and Windows Server 2003 fails to validate a length value, causing an integer overflow and unchecked buffer when handling compressed (zipped) folders. A remote attacker can craft a malicious archive that triggers the overflow and may lead to arbitrary code execution on the affected host.
Description
Integer overflow in DUNZIP32.DLL for Microsoft Windows XP, Windows XP 64-bit Edition, Windows Server 2003, and Windows Server 2003 64-bit Edition allows remote attackers to execute arbitrary code via compressed (zipped) folders that involve an "unchecked buffer" and improper length validation.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
high priorityThe CVSS 2.0 base score is 10.0 with network reachability and no authentication, but the affected platforms are long out of support and there is no KEV listing or confirmed exploit reference.
What it is
DUNZIP32.DLL on Windows XP and Windows Server 2003 fails to validate a length value, causing an integer overflow and unchecked buffer when handling compressed (zipped) folders. A remote attacker can craft a malicious archive that triggers the overflow and may lead to arbitrary code execution on the affected host.
Impact
Successful exploitation lets a remote attacker run arbitrary code with the privileges of the user or process that processes the archive, potentially leading to full system compromise.
Attack surface
The flaw is reached over the network (AV:N) with no authentication (Au:N) and low complexity (AC:L), typically by delivering a crafted compressed folder to a victim. User interaction is not reflected in the CVSS vector, but the description implies the archive must be opened or processed.
Exploitation
CVE-2004-0575 is not listed in CISA KEV and no ransomware usage is documented. EPSS shows a 30-day probability of 0.603 (99.1st percentile), indicating high modeled likelihood, though the record contains no reference tags confirming public exploit code.
What to do
- Apply Microsoft security bulletin MS04-034 to update DUNZIP32.DLL on affected Windows XP and Windows Server 2003 systems.
- Remove or restrict the compressed folders (ZIP) shell extension on systems that cannot be patched.
- Block or scan inbound ZIP archives at email and web gateways before they reach endpoints.
- Retire or isolate unsupported Windows XP and Windows Server 2003 hosts from untrusted networks.
Detection
- Monitor for DUNZIP32.DLL crashes or faults in Windows error reporting and application event logs.
- Alert on suspicious child processes spawned by explorer.exe or zipfldr.dll when opening archives.
- Hunt for unusual ZIP files with malformed or oversized length fields arriving via email or download.
- Review endpoint telemetry for code execution originating from compressed folder handling paths.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2004-0575 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2004-0575), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
