Vulnerability record · CVE-2005-0059 · published 2 May 2005
CVE-2005-0059: Microsoft Windows Message Queuing buffer overflow allows remote code execution
Microsoft · Windows 2000
The Message Queuing component in Microsoft Windows 2000 and Windows XP SP1 contains a buffer overflow that can be triggered by a crafted message. A remote, unauthenticated attacker can exploit this to execute arbitrary code on the affected system. The flaw is severe because it requires no authentication or user interaction and can lead to full system compromise.
Description
Buffer overflow in the Message Queuing component of Microsoft Windows 2000 and Windows XP SP1 allows remote attackers to execute arbitrary code via a crafted message.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
critical priorityCVSS 2.0 base score of 10.0 with network reachability, no authentication, and complete confidentiality, integrity, and availability impact, combined with a very high EPSS percentile, makes this a critical risk for unpatched systems.
What it is
The Message Queuing component in Microsoft Windows 2000 and Windows XP SP1 contains a buffer overflow that can be triggered by a crafted message. A remote, unauthenticated attacker can exploit this to execute arbitrary code on the affected system. The flaw is severe because it requires no authentication or user interaction and can lead to full system compromise.
Impact
Successful exploitation allows an attacker to execute arbitrary code with the privileges of the vulnerable service, potentially taking complete control of the host. This can result in data theft, malware installation, or use of the system as a foothold for further attacks.
Attack surface
The vulnerability is reachable over the network via the Message Queuing service, as indicated by the CVSS vector AV:N/AC:L/Au:N. No authentication or user interaction is required to send the crafted message.
Exploitation
The CVE is not listed in CISA KEV and has no known ransomware associations, but EPSS indicates a high probability of exploitation (0.73267, 99.4th percentile). No public exploit references are provided in the record.
What to do
- Apply the Microsoft security update MS05-017 immediately on all affected Windows 2000 and Windows XP SP1 systems.
- Disable the Message Queuing service if it is not required for business operations.
- Block inbound network access to Message Queuing ports (typically TCP 1801, 2101, 2103, 2105, 2107) at the perimeter and host firewalls.
- Upgrade or migrate from Windows 2000 and Windows XP SP1, which are no longer supported.
- Monitor for unexpected service crashes or unusual outbound connections from systems running Message Queuing.
Detection
- Monitor Windows event logs for Message Queuing service crashes or errors that may indicate exploitation attempts.
- Use network intrusion detection to alert on malformed or oversized messages directed at Message Queuing ports.
- Check for unexpected processes or network connections originating from the Message Queuing service account.
- Audit systems for the presence of the MS05-017 patch and flag unpatched hosts.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2005-0059 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2005-0059), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
