CVE-2004-0420
The Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP...
The Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by spoofing the type of a file via a CLSID specifier in the filename, as demonstrated using Internet Explorer 6.0.2800.1106 on Windows XP.
Exploit likelihood
What each source reports
NVD Score used
The Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by spoofing the type of a file via a CLSID specifier in the filename, as demonstrated using Internet Explorer 6.0.2800.1106 on Windows XP.
- Record
CVE-2004-0420- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
The Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by spoofing the type of a file via a CLSID specifier in the filename, as demonstrated using Internet Explorer 6.0.2800.1106 on Windows XP.
- Record
CVE-2004-0420- Updated
- 2026-11-02
EUVDEUVD-2004-0419 No score
The Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by spoofing the type of a file via a CLSID specifier in the filename, as demonstrated using Internet Explorer 6.0.2800.1106 on Windows XP.
- Record
EUVD-2004-0419- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-24gh-95jq-75q6 No score
The Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP...
The Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by spoofing the type of a file via a CLSID specifier in the filename, as demonstrated using Internet Explorer 6.0.2800.1106 on Windows XP.
- Record
GHSA-24gh-95jq-75q6- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2004-0420 is a high vulnerability (CVSS 10.0) in Microsoft Ie, published April 20, 2004. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 46.0%, the 98th percentile. No source names a fixed version.
References
exchange.xforce.ibmcloud.com/vulnerabilities/14964
securityfocus.com/bid/9510
us-cert.gov/cas/techalerts/TA04-196A.html
secunia.com/advisories/10736
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2894
Show 10 moreShow less
kb.cert.org/vuls/id/106324
security-express.com/archives/bugtraq/2004-01/0300.html
docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-024
nvd.nist.gov/vuln/detail/CVE-2004-0420
github.com/advisories/GHSA-24gh-95jq-75q6