CVE-2002-0694
Microsoft Windows HTML Help - Remote Code Execution via Malicious CHM File
Title source: llmDescription
The HTML Help facility in Microsoft Windows 98, 98 Second Edition, Millennium Edition, NT 4.0, NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP uses the Local Computer Security Zone when opening .chm files from the Temporary Internet Files folder, which allows remote attackers to execute arbitrary code via HTML mail that references or inserts a malicious .chm file containing shortcuts that can be executed, aka "Code Execution via Compiled HTML Help File."
References (3)
Core 3
Core References
Vendor Advisory vendor-advisory
x_refsource_ms
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-055
Third Party Advisory, VDB Entry vdb-entry
signature
x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A403
Vendor Advisory vdb-entry
x_refsource_xf
http://www.iss.net/security_center/static/10254.php
Scores
EPSS
0.1374
EPSS Percentile
96.1%
Details
Status
published
Products (7)
microsoft/windows_2000
(4 CPE variants)
microsoft/windows_2000_terminal_services
(4 CPE variants)
microsoft/windows_98
microsoft/windows_98se
microsoft/windows_me
microsoft/windows_nt
4.0 (32 CPE variants)
microsoft/windows_xp
(3 CPE variants)
Published
Oct 10, 2002
Tracked Since
Feb 18, 2026