CVE-2002-2401: Microsoft Windows 2000

Low severity, CVSS 3.6. EPSS: 1.8% chance of exploitation in the next 30 days.

NT Virtual DOS Machine (NTVDM.EXE) in Windows 2000, NT and XP does not verify user execution permissions for 16-bit executable files, which allows local users to bypass the loader and execute arbitrary programs.

Affected products

• Microsoft Windows 2000: any version
• Microsoft Windows Nt: version 4.0 only
• Microsoft Windows XP: any version

Published 2002-12-31. Last modified 2026-06-16.