CVE-2003-0525
The getCanonicalPath function in Windows NT 4.0 may free memory that it does not own and cause...
The getCanonicalPath function in Windows NT 4.0 may free memory that it does not own and cause heap corruption, which allows attackers to cause a denial of service (crash) via requests that cause a long file name to be passed to getCanonicalPath, as demonstrated on the IBM JVM using a long string to the java.io.getCanonicalPath Java method.
Exploit likelihood
What each source reports
NVD Score used
The getCanonicalPath function in Windows NT 4.0 may free memory that it does not own and cause heap corruption, which allows attackers to cause a denial of service (crash) via requests that cause a long file name to be passed to getCanonicalPath, as demonstrated on the IBM JVM using a long string to the java.io.getCanonicalPath Java method.
- Record
CVE-2003-0525- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
The getCanonicalPath function in Windows NT 4.0 may free memory that it does not own and cause heap corruption, which allows attackers to cause a denial of service (crash) via requests that cause a long file name to be passed to getCanonicalPath, as demonstrated on the IBM JVM using a long string to the java.io.getCanonicalPath Java method.
- Record
CVE-2003-0525- Updated
- 2026-11-02
EUVDEUVD-2003-0519 No score
The getCanonicalPath function in Windows NT 4.0 may free memory that it does not own and cause heap corruption, which allows attackers to cause a denial of service (crash) via requests that cause a long file name to be passed to getCanonicalPath, as demonstrated on the IBM JVM using a long string to the java.io.getCanonicalPath Java method.
- Record
EUVD-2003-0519- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8857-6ch2-mpr7 No score
The getCanonicalPath function in Windows NT 4.0 may free memory that it does not own and cause...
The getCanonicalPath function in Windows NT 4.0 may free memory that it does not own and cause heap corruption, which allows attackers to cause a denial of service (crash) via requests that cause a long file name to be passed to getCanonicalPath, as demonstrated on the IBM JVM using a long string to the java.io.getCanonicalPath Java method.
- Record
GHSA-8857-6ch2-mpr7- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2003-0525 is a medium vulnerability (CVSS 5.0) in Microsoft Windows Nt, published July 25, 2003. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.71%, the 94th percentile. No source names a fixed version.
References
atstake.com/research/advisories/2003/a072303-1.txt
docs.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-029
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A319
exchange.xforce.ibmcloud.com/vulnerabilities/12701
nvd.nist.gov/vuln/detail/CVE-2003-0525
github.com/advisories/GHSA-8857-6ch2-mpr7