CVE-2004-1305: Windows ANI cursor parsing flaw allows remote denial of service

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

medium priorityRemote, unauthenticated denial of service with high EPSS, but impact is limited to availability and patches have long been available.

What it is

The Windows Animated Cursor (ANI) handler in Windows NT, 2000 SP4, XP SP1 and Server 2003 mishandles malformed cursor files. Setting the frame number to zero causes use of an invalid memory address and a kernel crash, while setting the rate number to zero causes resource exhaustion and a hang. Both are remote denial-of-service conditions against unpatched systems.

Impact

An attacker can crash or hang the affected Windows kernel, disrupting availability of the host. No confidentiality or integrity impact is described; the CVSS vector rates availability impact as partial.

Attack surface

Reachable over the network with no authentication required (AV:N/AC:L/Au:N), consistent with delivery of a crafted ANI file to a victim system. The record does not state whether user interaction such as opening or previewing the cursor is required.

Exploitation

Not listed in CISA KEV and no ransomware association is documented. EPSS is high (0.586, ~99th percentile), and references include a vendor advisory and patch-tagged CERT/US-CERT bulletins, but the record does not confirm public exploit code.

What to do

• Apply the Microsoft security update referenced in MS05-002 (and the CERT/US-CERT patch advisories) to all affected Windows versions.
• Upgrade or retire unsupported platforms listed as affected, including Windows NT, 98, 98SE and ME, which no longer receive fixes.
• Block or strip untrusted .ani and cursor files at mail and web gateways where feasible.
• Apply the same patching to Nortel products listed as affected (Symposium and Media Communication Server lines) per vendor guidance.

Detection

• Monitor for unexpected kernel crashes or bugchecks on Windows hosts and correlate with recently opened cursor or ANI files.
• Alert on repeated system hangs or resource exhaustion events on unpatched legacy Windows systems.
• Hunt for .ani files arriving via email or web download on hosts running the affected Windows versions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.