CVE-1999-1104: Microsoft Windows 95

Medium severity, CVSS 4.6. EPSS: 1% chance of exploitation in the next 30 days.

Windows 95 uses weak encryption for the password list (.pwl) file used when password caching is enabled, which allows local users to gain privileges by decrypting the passwords.

Affected products

• Microsoft Windows 95: any version

Published 1999-12-31. Last modified 2026-06-16.