Vulnerability record · CVE-2005-2123 · published 29 November 2005
CVE-2005-2123: Windows GDI32.DLL integer overflows in WMF/EMF image parsing
Microsoft · Windows 2000
Multiple integer overflows in the Graphics Rendering Engine (GDI32.DLL) on Windows 2000 SP4, XP SP1/SP2 and Server 2003 SP1 allow remote code execution via crafted Windows Metafile (WMF) and Enhanced Metafile (EMF) images that trigger heap-based buffer overflows. The flaw is reachable without authentication and is demonstrated through MRBP16::bCheckRecord, making malformed image files a viable attack vector.
Description
Multiple integer overflows in the Graphics Rendering Engine (GDI32.DLL) in Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allow remote attackers to execute arbitrary code via crafted Windows Metafile (WMF) and Enhanced Metafile (EMF) format images that lead to heap-based buffer overflows, as demonstrated using MRBP16::bCheckRecord.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityCVSS 2.0 base score 7.5 with network reachability, no authentication and no user interaction, plus a very high EPSS percentile, though no KEV listing or confirmed exploitation is documented.
What it is
Multiple integer overflows in the Graphics Rendering Engine (GDI32.DLL) on Windows 2000 SP4, XP SP1/SP2 and Server 2003 SP1 allow remote code execution via crafted Windows Metafile (WMF) and Enhanced Metafile (EMF) images that trigger heap-based buffer overflows. The flaw is reachable without authentication and is demonstrated through MRBP16::bCheckRecord, making malformed image files a viable attack vector.
Impact
An attacker can execute arbitrary code in the context of the process that renders the crafted image, potentially leading to full system compromise. Because the vulnerable component is a core graphics library, any application that parses WMF/EMF content may be affected.
Attack surface
Reached remotely over the network (AV:N) with no authentication (Au:N) and no user interaction required per the CVSS vector, typically by delivering a malicious WMF/EMF image to a rendering or parsing service. The description does not specify the exact delivery mechanism beyond crafted image files.
Exploitation
Not listed in CISA KEV and no ransomware associations are documented; EPSS is high at 0.61477 (99.1st percentile), and references include Patch and Vendor Advisory tags, indicating a known, patchable issue rather than confirmed in-the-wild exploitation.
What to do
- Apply Microsoft security bulletin MS05-053 (or the corresponding vendor patch) to affected Windows 2000 SP4, XP SP1/SP2 and Server 2003 SP1 systems.
- Restrict or block untrusted WMF/EMF files at email gateways, web proxies and file-share ingress points.
- Disable or harden any service or application that automatically renders WMF/EMF images from untrusted sources.
- Where feasible, migrate off the affected legacy Windows versions, which are no longer supported.
Detection
- Monitor for processes loading GDI32.DLL while processing WMF/EMF files from external or untrusted locations.
- Alert on crashes or heap corruption events in graphics rendering processes that handle image files.
- Hunt for WMF/EMF files with anomalous record structures or unusually large size fields in email and web traffic.
- Correlate endpoint telemetry for image-rendering applications spawning unexpected child processes.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2005-2123 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2005-2123), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
