CVE-2004-0210

HIGH KEV

Microsoft Interix - Local Buffer Overflow via POSIX Component

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2004-0210 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added March 3, 2022. EIP tracks 1 public exploit from researchers including bkbll.

AI-analyzed exploit summary This exploit targets a local buffer overflow in the Microsoft POSIX subsystem (CVE-2004-0210) to escalate privileges to SYSTEM. It injects shellcode into a suspended process and modifies its execution flow to trigger the vulnerability.

Description

The POSIX component of Microsoft Windows NT and Windows 2000 allows local users to execute arbitrary code via certain parameters, possibly by modifying message length values and causing a buffer overflow.

Exploits (1)

exploitdb WORKING POC VERIFIED
by bkbll · clocalwindows
https://www.exploit-db.com/exploits/24277

This exploit targets a local buffer overflow in the Microsoft POSIX subsystem (CVE-2004-0210) to escalate privileges to SYSTEM. It injects shellcode into a suspended process and modifies its execution flow to trigger the vulnerability.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Windows POSIX Subsystem (Windows 2000 SP4, potentially others)
Auth required
Prerequisites: Local access to the target system · POSIX subsystem installed
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (7)

Core 7
Core References
Broken Link, Patch, Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert
http://www.us-cert.gov/cas/techalerts/TA04-196A.html
Patch, Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/647436
Patch, Vendor Advisory vendor-advisory x_refsource_ms
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-020
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/16590

Scores

CVSS v3 7.8
EPSS 0.0679
EPSS Percentile 91.6%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Details

CISA KEV 2022-03-03
VulnCheck KEV 2022-03-03
InTheWild.io 2022-03-03
ENISA EUVD EUVD-2004-0210
CWE
CWE-120
Status published
Products (3)
microsoft/interix 2.2
microsoft/windows_2000 (3 CPE variants)
microsoft/windows_nt 4.0 sp6a (3 CPE variants)
Published Aug 06, 2004
KEV Added Mar 03, 2022
Tracked Since Feb 18, 2026