CVE-2004-2289: Microsoft Windows XP

High severity, CVSS 10.0. EPSS: 23.3% chance of exploitation in the next 30 days.

Microsoft Windows XP Explorer allows local users to execute arbitrary code via a system folder with a Desktop.ini file containing a .ShellClassInfo specifier with a CLSID value that is associated with an executable file.

Affected products

• Microsoft Windows XP: any version

Published 2004-12-31. Last modified 2026-06-16.