CVE-2004-0200: Microsoft .NET Framework

High severity, CVSS 9.3. EPSS: 49% chance of exploitation in the next 30 days.

Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation.

Affected products

• Microsoft .NET Framework: version 1.0 only
• Microsoft Digital Image Pro: version 7.0 only; version 9 only
• Microsoft Digital Image Suite: version 9 only
• Microsoft Excel: version 2002 only; version 2003 only
• Microsoft Frontpage: version 2002 only; version 2003 only
• Microsoft Greetings: version 2002 only
• Microsoft Infopath: version 2003 only
• Microsoft Office: version 2003 only; version xp only
• Microsoft Onenote: version 2003 only
• Microsoft Outlook: version 2002 only; version 2003 only
• Microsoft Picture It: version 7.0 only; version 9 only; version 2002 only
• Microsoft PowerPoint: version 2002 only; version 2003 only
• Microsoft Producer: any version
• Microsoft Project: version 2002 only; version 2003 only
• Microsoft Publisher: version 2002 only; version 2003 only
• Microsoft Visio: version 2002 only; version 2003 only
• Microsoft Visual Basic: version 2002 only; version 2003 only
• Microsoft Visual C#: version 2002 only; version 2003 only
• Microsoft Visual C++: version 2002 only; version 2003 only
• Microsoft Visual J# .net: version 2003 only
• Microsoft Visual Studio .net: version 2002 only; version 2003 only
• Microsoft Windows 2003 Server: version r2 only
• Microsoft Windows XP: any version
• Microsoft Word: version 2002 only; version 2003 only

Published 2004-09-28. Last modified 2026-06-16.