CVE-2005-1208: Microsoft Windows 2000

High severity, CVSS 10.0. EPSS: 47.3% chance of exploitation in the next 30 days.

Integer overflow in Microsoft Windows 98, 2000, XP SP2 and earlier, and Server 2003 SP1 and earlier allows remote attackers to execute arbitrary code via a crafted compiled Help (.CHM) file with a large size field that triggers a heap-based buffer overflow, as demonstrated using a "ms-its:" URL in Internet Explorer.

Affected products

• Microsoft Windows 2000: any version
• Microsoft Windows 2003 Server: version 64-bit only; version datacenter_64-bit only; version enterprise only; version enterprise_64-bit only; version r2 only; version standard only; …
• Microsoft Windows 98: any version
• Microsoft Windows XP: any version

Published 2005-06-14. Last modified 2026-06-16.