CVE-2005-0063: Windows Shell document processing CLSID abuse enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityRemote code execution with no authentication and a high EPSS score, though exploitation requires the victim to open a crafted document and the affected platforms are long out of support.

What it is

The Windows Shell document processing application on Windows 2000, XP, and Server 2003 fails to properly validate the CLSID stored in a file, allowing a crafted document to be routed to the HTML Application Host (MSHTA) instead of its intended handler. Because MSHTA executes script content, a remote attacker can turn a seemingly benign file such as a Word document into a code execution vector. This is a 2005-era flaw affecting legacy Windows platforms.

Impact

An attacker who gets a victim to open the crafted document can execute arbitrary code with the victim's privileges, giving full control of the affected host. No elevation is required beyond the logged-on user's rights.

Attack surface

Reached remotely over the network by delivering a malicious document to the target; the CVSS vector AV:N/AC:L/Au:N indicates no authentication is needed, but successful exploitation depends on the victim opening the file, so user interaction is required. The flaw is in the Shell's document handler selection, not in a network service.

Exploitation

CVE-2005-0063 is not listed in CISA KEV and has no ransomware associations, but EPSS is high at roughly 0.476 (98.8th percentile), and public exploit references exist, indicating meaningful real-world exploitation potential.

What to do

• Apply Microsoft security bulletin MS05-016 (the vendor patch referenced for this issue) to all affected Windows 2000, XP, and Server 2003 systems.
• Retire or isolate unsupported legacy Windows versions (Windows 98, 98SE, ME, 2000) that cannot receive current fixes.
• Block or restrict MSHTA execution and enforce file-type association controls so documents cannot be silently rerouted to the HTML Application Host.
• Filter inbound email and web downloads to strip or quarantine documents with unexpected embedded CLSID or script content.
• Apply least privilege so users do not operate as local administrators, limiting the value of code execution.

Detection

• Monitor process creation for mshta.exe spawned by document viewers such as winword.exe or explorer.exe, which is abnormal for normal document handling.
• Alert on files whose embedded CLSID resolves to the HTML Application Host rather than the expected document handler.
• Review email gateway and proxy logs for inbound documents from untrusted senders that trigger mshta.exe on endpoints.
• Use the available OVAL definitions to scan for unpatched systems matching this vulnerability.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.