Vulnerability record · CVE-2005-1978 · published 12 October 2005
CVE-2005-1978: Microsoft COM+ memory structure flaw allows arbitrary code execution
Microsoft · Windows 2000
COM+ in Microsoft Windows does not properly create and use memory structures, allowing code execution. The record gives no root-cause detail beyond that phrase, so the exact memory-safety mechanism is unclear. It matters because COM+ is a core Windows component and the flaw affects Windows 2000, 2003 Server and XP.
Description
COM+ in Microsoft Windows does not properly "create and use memory structures," which allows local users or remote attackers to execute arbitrary code.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityNetwork-reachable, no authentication required, partial impact across three Windows versions, and a very high EPSS score, though no confirmed exploitation is recorded.
What it is
COM+ in Microsoft Windows does not properly create and use memory structures, allowing code execution. The record gives no root-cause detail beyond that phrase, so the exact memory-safety mechanism is unclear. It matters because COM+ is a core Windows component and the flaw affects Windows 2000, 2003 Server and XP.
Impact
An attacker can execute arbitrary code with the privileges of the vulnerable COM+ process. The CVSS 2.0 vector rates confidentiality, integrity and availability impact as partial.
Attack surface
The CVSS 2.0 vector AV:N/AC:L/Au:N indicates the flaw is reachable over the network with no authentication and low complexity. The description also states local users can trigger it, so both local and remote paths appear possible; no user interaction is indicated.
Exploitation
Not listed in CISA KEV and no reference carries an exploit tag, so confirmed in-the-wild exploitation is not established. EPSS is high (0.534, 98.9th percentile), indicating elevated predicted exploitation likelihood.
What to do
- Apply Microsoft security bulletin MS05-051 (the vendor fix for this issue) on all affected Windows 2000, 2003 Server and XP systems.
- Restrict network access to COM+ and DCOM/RPC endpoints to trusted hosts only, since the vector is network-reachable without authentication.
- Disable or remove unnecessary COM+ applications and services on hosts that do not require them.
- Isolate legacy Windows 2000/XP/2003 systems on segmented networks and prioritize them for upgrade or decommissioning.
Detection
- Monitor for unexpected child processes spawned by COM+ related processes (dllhost.exe, svchost.exe hosting COM+ services).
- Alert on anomalous network traffic to RPC/DCOM ports from untrusted sources.
- Audit COM+ application and service configuration changes and unexpected registration of COM components.
- Correlate host logs for crashes or memory errors in COM+ processes with subsequent suspicious process creation.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2005-1978 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2005-1978), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
