CVE-2004-1595: ShixxNote font field buffer overflow allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityNetwork-reachable, unauthenticated buffer overflow with public exploit references and very high EPSS percentile, though no KEV listing or confirmed in-the-wild activity is recorded.

What it is

ShixxNote 6.net build 117 contains a buffer overflow in its handling of a font field. A remote attacker can send a crafted value that overflows the buffer, potentially leading to arbitrary code execution on the affected host. The record does not specify the exact protocol or message type carrying the font field.

Impact

An attacker who successfully triggers the overflow may execute arbitrary code in the context of the ShixxNote process, giving them control of the affected system.

Attack surface

The CVSS vector AV:N/AC:L/Au:N indicates the flaw is reachable over the network with no authentication and low complexity. The description does not state whether any user interaction is required to process the malicious font field.

Exploitation

CVE-2004-1595 is not listed in CISA KEV, but EPSS shows a 30-day probability of 0.5932 (99.075th percentile), and two references are tagged Exploit, indicating public exploit material exists.

What to do

• Apply the vendor fix or upgrade ShixxNote past 6.net build 117; no patched version is named in the record, so confirm with the vendor.
• If no fix is available, restrict network exposure of ShixxNote services to trusted hosts and block untrusted traffic to the affected port or interface.
• Run ShixxNote with least privilege so a successful overflow does not yield administrative rights.
• Monitor vendor and Secunia/SecurityFocus advisories for updated guidance, since the record is old and may be incomplete.

Detection

• Inspect network traffic to ShixxNote for oversized or malformed font field values.
• Monitor ShixxNote process crashes or abnormal termination events on endpoints.
• Watch for unexpected child processes or code execution spawned by the ShixxNote process.
• Review host logs for anomalous outbound connections originating from the ShixxNote process.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.