← Vulnerability feed

Vulnerability record · CVE-2004-0900 · published 10 January 2005

CVE-2004-0900: Microsoft windows nt vulnerability

Microsoft · Windows Nt

The DHCP Server service for Microsoft Windows NT 4.0 Server and Terminal Server Edition does not properly validate the length of certain messages, which allows remote attackers to execute arbitrary code via a malformed DHCP message, aka the "DHCP Request Vulnerability."

10.0 CVSS 2.0 High EPSS 26% · top 2.1%
10.0CVSS 2.0 base score
26%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References
16 Jun 2026Last modified by NVD

Description

The DHCP Server service for Microsoft Windows NT 4.0 Server and Terminal Server Edition does not properly validate the length of certain messages, which allows remote attackers to execute arbitrary code via a malformed DHCP message, aka the "DHCP Request Vulnerability."

AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-042
https://exchange.xforce.ibmcloud.com/vulnerabilities/18342
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3577
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4846
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-042
https://exchange.xforce.ibmcloud.com/vulnerabilities/18342
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3577
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4846

Track CVE-2004-0900 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2004-0210Microsoft Windows POSIX component buffer overflow allows local code executionThe POSIX subsystem in Windows NT and Windows 2000 contains a classic buffer overflow (CWE-120) that can be triggered by local users through crafted …KEVEPSS 7.2%analysed7.8CVE-2002-0367Windows NT/2000 smss.exe debugging subsystem privilege escalationThe smss.exe debugging subsystem in Windows NT and Windows 2000 fails to properly authenticate programs that connect to other programs, allowing a lo…KEVEPSS 4.9%analysed10.0CVE-2005-0050Windows License Logging Service buffer overflow via unvalidated message lengthThe License Logging service in Windows NT Server, Windows 2000 Server and Windows Server 2003 fails to validate the length of messages, producing an …EPSS 47%analysed10.0CVE-2004-0568Microsoft windows 2000 vulnerabilityHyperTerminal application for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the length of a value that…EPSS 35%10.0CVE-2004-0571Microsoft windows 2000 vulnerabilityMicrosoft Word for Windows 6.0 Converter does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via…EPSS 31%10.0CVE-2004-0901Microsoft windows 2000 vulnerabilityMicrosoft Word for Windows 6.0 Converter (MSWRD632.WPC), as used in WordPad, does not properly validate certain data lengths, which allows remote att…EPSS 32%10.0CVE-2004-1080Microsoft WINS Service Memory Corruption via Replication PacketThe WINS service (wins.exe) on Windows NT Server 4.0, Windows 2000 Server, and Windows Server 2003 mishandles a modified memory pointer in a WINS rep…EPSS 80%analysed10.0CVE-2004-0574Microsoft NNTP XPAT pattern buffer overflow allows remote code executionThe NNTP component in Windows NT Server 4.0, Windows 2000 Server, Windows Server 2003, Exchange 2000 Server and Exchange Server 2003 mishandles XPAT …EPSS 64%analysed

Source: NIST National Vulnerability Database (record CVE-2004-0900), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.