CVE-2004-0848: Microsoft Office

High severity, CVSS 7.5. EPSS: 27.5% chance of exploitation in the next 30 days.

Buffer overflow in Microsoft Office XP allows remote attackers to execute arbitrary code via a link with a URL file location containing long inputs after (1) "%00 (null byte) in .doc filenames or (2) "%0a" (carriage return) in .rtf filenames.

Affected products

• Microsoft Office: any version; version xp only
• Microsoft PowerPoint: version 2002 only
• Microsoft Project: version 2002 only
• Microsoft Visio: version 2002 only
• Microsoft Word: version 2002 only
• Microsoft Works: version 2002 only; version 2003 only; version 2004 only

Published 2005-02-08. Last modified 2026-06-16.