CVE-2004-1306

Windows NT, 2000, XP, 2003 - Remote Code Execution via Crafted .hlp File

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2004-1306. PoCs published by flashsky fangxing.

AI-analyzed exploit summary The provided text describes an integer overflow vulnerability in Microsoft Windows' winhlp32.exe when processing malformed compressed Windows Help files (.hlp). Successful exploitation could lead to arbitrary code execution in the context of the user opening the malicious file.

Description

Heap-based buffer overflow in winhlp32.exe in Windows NT, Windows 2000 through SP4, Windows XP through SP2, and Windows 2003 allows remote attackers to execute arbitrary code via a crafted .hlp file.

Exploits (1)

exploitdb WRITEUP VERIFIED
by flashsky fangxing · textremotewindows
https://www.exploit-db.com/exploits/25049

The provided text describes an integer overflow vulnerability in Microsoft Windows' winhlp32.exe when processing malformed compressed Windows Help files (.hlp). Successful exploitation could lead to arbitrary code execution in the context of the user opening the malicious file.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Theoretical
Target: Microsoft Windows winhlp32.exe
No auth needed
Prerequisites: Malformed .hlp file · User interaction to open the file
mistral-large-3 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/12092
Exploit x_refsource_misc
http://www.xfocus.net/flashsky/icoExp/
Mailing List mailing-list x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=110383690219440&w=2
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/18678

Scores

EPSS 0.1960
EPSS Percentile 97.1%

Details

Status published
Products (9)
microsoft/windows_2000 (5 CPE variants)
microsoft/windows_2003_server datacenter_64-bit sp1_beta_1
microsoft/windows_2003_server enterprise (2 CPE variants)
microsoft/windows_2003_server enterprise_64-bit (2 CPE variants)
microsoft/windows_2003_server r2 (3 CPE variants)
microsoft/windows_2003_server standard (2 CPE variants)
microsoft/windows_2003_server web (2 CPE variants)
microsoft/windows_nt 4.0 (32 CPE variants)
microsoft/windows_xp
Published Dec 31, 2004
Tracked Since Feb 18, 2026