HOMEVULNERABILITIESCVE-2004-0574
CRITICALPOC

CVE-2004-0574

CWE-787Published: November 3, 2004· Updated: Jun 16, 2026

10.0
CVSS v3.1

Official Description

The Network News Transfer Protocol (NNTP) component of Microsoft Windows NT Server 4.0, Windows 2000 Server, Windows Server 2003, Exchange 2000 Server, and Exchange Server 2003 allows remote attackers to execute arbitrary code via XPAT patterns, possibly related to improper length validation and an "unchecked buffer," leading to off-by-one and heap-based buffer overflows.

NVD Source

Technical Analysis

CVE-2004-0574 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A proof-of-concept (PoC) exploit exists for CVE-2004-0574. While not yet confirmed in active campaigns, the availability of PoC code increases exploitation risk substantially.

From a weakness classification perspective (CWE-787): Out-of-bounds write vulnerabilities can lead to data corruption, crashes, or arbitrary code execution.

CVSS v3.1 Vector Breakdown

Exploitability
Attack VectorNetwork
Attack ComplexityLow
Privileges Req.
User Interaction
Scope
Impact
ConfidentialityC
IntegrityC
AvailabilityC
AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected Vendors & Products

Microsoft4 product(s)
exchange serverwindows 2000windows ntwindows server 2003
Source: NVD CPE · 5 total CPE entries

Exploit & PoC Resources

POC AVAILABLEProof-of-concept code exists
Exploit-DB
Offensive Security exploit database
GitHub PoC Search
Community PoC repositories
Rapid7 / Metasploit
Metasploit module search
PacketStorm
Security advisories & exploits
NVD Detail
Official NIST entry
MITRE CVE
CVE Program entry
External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

PATCHhttp://www.kb.cert.org/vuls/id/203126
PATCHhttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-036
PATCHhttp://www.kb.cert.org/vuls/id/203126
PATCHhttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-036
ADVISORYhttp://marc.info/?l=bugtraq&m=109761632831563&w=2
ADVISORYhttp://www.coresecurity.com/common/showdoc.php?idx=420&idxseccion=10
ADVISORYhttps://exchange.xforce.ibmcloud.com/vulnerabilities/17641
ADVISORYhttps://exchange.xforce.ibmcloud.com/vulnerabilities/17661
ADVISORYhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A246
ADVISORYhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4392
ADVISORYhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5021
ADVISORYhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5070
ADVISORYhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5926
ADVISORYhttp://marc.info/?l=bugtraq&m=109761632831563&w=2
ADVISORYhttp://www.coresecurity.com/common/showdoc.php?idx=420&idxseccion=10
ADVISORYhttps://exchange.xforce.ibmcloud.com/vulnerabilities/17641
ADVISORYhttps://exchange.xforce.ibmcloud.com/vulnerabilities/17661
ADVISORYhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A246
ADVISORYhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4392
ADVISORYhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5021
ADVISORYhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5070
ADVISORYhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5926

All References (24)

→
http://marc.info/?l=bugtraq&m=109761632831563&w=2Mailing List · Third Party Advisory
→
http://www.ciac.org/ciac/bulletins/p-012.shtmlBroken Link
→
http://www.coresecurity.com/common/showdoc.php?idx=420&idxseccion=10Third Party Advisory
→
http://www.kb.cert.org/vuls/id/203126Patch · Third Party Advisory · US Government Resource
→
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-036Patch · Vendor Advisory
→
https://exchange.xforce.ibmcloud.com/vulnerabilities/17641Third Party Advisory · VDB Entry
→
https://exchange.xforce.ibmcloud.com/vulnerabilities/17661Third Party Advisory · VDB Entry
→
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A246Third Party Advisory
→
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4392Third Party Advisory
→
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5021Third Party Advisory
→
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5070Third Party Advisory
→
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5926Third Party Advisory
→
http://marc.info/?l=bugtraq&m=109761632831563&w=2Mailing List · Third Party Advisory
→
http://www.ciac.org/ciac/bulletins/p-012.shtmlBroken Link
→
http://www.coresecurity.com/common/showdoc.php?idx=420&idxseccion=10Third Party Advisory

Quick Facts

CVE IDCVE-2004-0574
CVSS Score10.0 / 10
SeverityCRITICAL
WeaknessCWE-787
CISA KEVNo
ExploitPOC
Affected1 vendor(s)
PublishedNov 3, 2004

Related CVEs (CWE-787)

CVE-2013-5610
10.0
CVE-2015-5096
10.0
CVE-2009-2466
10.0
CVE-2002-2227
10.0
CVE-2014-1478
10.0
CVE-2015-5098
10.0

Recommended Actions

  • →Apply vendor patches immediately
  • →Monitor CVE-2004-0574 in threat intel feeds
  • →Review IDS/IPS signatures for exploitation attempts
Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWATCH.COM. CVE data is provided under the NVD usage policy.
← All Vulnerabilities·Search for CVE-2004-0574·NVD