CVE-2004-1305: Microsoft Windows 2000

Medium severity, CVSS 5.0. EPSS: 58.6% chance of exploitation in the next 30 days.

The Windows Animated Cursor (ANI) capability in Windows NT, Windows 2000 through SP4, Windows XP through SP1, and Windows 2003 allow remote attackers to cause a denial of service via (1) the frame number set to zero, which causes an invalid memory address to be used and leads to a kernel crash, or (2) the rate number set to zero, which leads to resource exhaustion and hang.

Affected products

• Microsoft Windows 2000: any version
• Microsoft Windows 2003 Server: version enterprise only; version enterprise_64-bit only; version r2 only; version standard only; version web only
• Microsoft Windows 98: any version
• Microsoft Windows 98se: any version
• Microsoft Windows Me: any version
• Microsoft Windows Nt: version 4.0 only
• Microsoft Windows XP: any version
• Nortel IP Softphone 2050: any version
• Nortel Media Communication Server 5100: version 3.0 only
• Nortel Media Communication Server 5200: version 3.0 only
• Nortel Media Processing Server: any version
• Nortel Periphonics: any version
• Nortel Symposium Agent: any version
• Nortel Symposium Call Center Server: any version
• Nortel Symposium Express Call Center: any version
• Nortel Symposium Network Control Center: any version
• Nortel Symposium Tapi Service Provider: any version
• Nortel Symposium Web Centre Portal: any version
• Nortel Symposium Web Client: any version

Published 2004-12-23. Last modified 2026-06-16.