Vulnerability record · CVE-2005-2118 · published 21 October 2005
CVE-2005-2118: Windows Shell .lnk Long Font Properties Buffer Overflow
Microsoft · Windows 2000
The Windows Shell in Windows 2000 SP4, XP SP1/SP2, and Server 2003 contains a buffer overflow triggered by a crafted shortcut (.lnk) file with long font properties. Viewing the file's properties in Windows Explorer causes the overflow, allowing remote code execution. It is distinct from CVE-2005-2122.
Description
Windows Shell for Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote user-assisted attackers to execute arbitrary commands via a crafted shortcut (.lnk) file with long font properties that lead to a buffer overflow when the user views the file's properties using Windows Explorer, a different vulnerability than CVE-2005-2122.
AV:N/AC:H/Au:N/C:P/I:P/A:P
Automated analysis
medium priorityCVSS 2.0 base score is 5.1 (MEDIUM) and exploitation requires user interaction, but the flaw allows arbitrary code execution and EPSS is high.
What it is
The Windows Shell in Windows 2000 SP4, XP SP1/SP2, and Server 2003 contains a buffer overflow triggered by a crafted shortcut (.lnk) file with long font properties. Viewing the file's properties in Windows Explorer causes the overflow, allowing remote code execution. It is distinct from CVE-2005-2122.
Impact
An attacker can execute arbitrary commands with the privileges of the user who views the shortcut's properties. This can lead to full compromise of the user's session and any data or credentials accessible to that account.
Attack surface
Reached remotely by delivering a malicious .lnk file (e.g., via email, web download, or shared folder) and convincing the user to view its properties in Windows Explorer. No authentication is required, but user interaction is necessary.
Exploitation
Not listed in CISA KEV and no public exploit tags in the references, though EPSS is high (0.47, 98.8th percentile). Exploitation requires user-assisted delivery and interaction.
What to do
- Apply Microsoft security bulletin MS05-049 (or the corresponding vendor patch) to affected Windows versions.
- Upgrade or migrate from Windows 2000 SP4, XP SP1/SP2, and Server 2003 to supported operating systems.
- Block or quarantine .lnk files from untrusted sources at email and web gateways.
- Educate users not to open or view properties of unexpected shortcut files.
- Restrict execution and file sharing of .lnk files via application control or group policy where feasible.
Detection
- Monitor for Explorer.exe crashes or abnormal child process creation following .lnk file access.
- Scan file shares, email attachments, and download directories for .lnk files with unusually long font property fields.
- Use endpoint detection to alert on command-shell or script execution spawned by explorer.exe.
- Review Windows Shell and Explorer-related event logs for suspicious shortcut handling around the time of user file access.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2005-2118 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2005-2118), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
