CVE-2003-0659
Buffer overflow in a function in User32.dll on Windows NT through Server 2003 allows local users...
Buffer overflow in a function in User32.dll on Windows NT through Server 2003 allows local users to execute arbitrary code via long (1) LB_DIR messages to ListBox or (2) CB_DIR messages to ComboBox controls in a privileged application.
Exploit likelihood
What each source reports
NVD Score used
Buffer overflow in a function in User32.dll on Windows NT through Server 2003 allows local users to execute arbitrary code via long (1) LB_DIR messages to ListBox or (2) CB_DIR messages to ComboBox controls in a privileged application.
- Record
CVE-2003-0659- CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
Buffer overflow in a function in User32.dll on Windows NT through Server 2003 allows local users to execute arbitrary code via long (1) LB_DIR messages to ListBox or (2) CB_DIR messages to ComboBox controls in a privileged application.
- Record
CVE-2003-0659- Updated
- 2026-11-02
EUVDEUVD-2003-0653 No score
Buffer overflow in a function in User32.dll on Windows NT through Server 2003 allows local users to execute arbitrary code via long (1) LB_DIR messages to ListBox or (2) CB_DIR messages to ComboBox controls in a privileged application.
- Record
EUVD-2003-0653- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r2mc-qrj9-9325 No score
Buffer overflow in a function in User32.dll on Windows NT through Server 2003 allows local users...
Buffer overflow in a function in User32.dll on Windows NT through Server 2003 allows local users to execute arbitrary code via long (1) LB_DIR messages to ListBox or (2) CB_DIR messages to ComboBox controls in a privileged application.
- Record
GHSA-r2mc-qrj9-9325- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Microsoft Windows - ListBox/ComboBox Control Local (MS03-045) | 2003-11-14 |
| Exploit-DB | Microsoft ListBox/ComboBox Control - 'User32.dll' Buffer Overrun | 2003-10-15 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2003-0659 is a high vulnerability (CVSS 7.2) in Microsoft Windows Nt, published October 17, 2003. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 43.0%, the 98th percentile. No source names a fixed version.
References
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A201
cert.org/advisories/CA-2003-27.html
exchange.xforce.ibmcloud.com/vulnerabilities/13424
securityfocus.com/bid/8827
marc.info?l=bugtraq&m=106631999907035&w=2
docs.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-045