Description
Buffer overflow in Microsoft Office XP allows remote attackers to execute arbitrary code via a link with a URL file location containing long inputs after (1) "%00 (null byte) in .doc filenames or (2) "%0a" (carriage return) in .rtf filenames.
References (7)
Core 7
Core References
Patch, Third Party Advisory, US Government Resource third-party-advisory
x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/416001
Vendor Advisory vendor-advisory
x_refsource_ms
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-005
Third Party Advisory, VDB Entry vdb-entry
signature
x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2738
Third Party Advisory, VDB Entry vdb-entry
signature
x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2348
Patch, Third Party Advisory, US Government Resource third-party-advisory
x_refsource_cert
http://www.us-cert.gov/cas/techalerts/TA05-039A.html
Third Party Advisory, VDB Entry vdb-entry
signature
x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4022
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/19107
Scores
EPSS
0.2749
EPSS Percentile
97.9%
Details
Status
published
Products (9)
microsoft/office
microsoft/office
xp sp1 (3 CPE variants)
microsoft/powerpoint
2002 (4 CPE variants)
microsoft/project
2002 (2 CPE variants)
microsoft/visio
2002 (5 CPE variants)
microsoft/word
2002 (4 CPE variants)
microsoft/works
2002
microsoft/works
2003
microsoft/works
2004
Published
Feb 08, 2005
Tracked Since
Feb 18, 2026