CVE-2004-2339 json
Microsoft Windows 2000, XP, and possibly 2003 allows local users with the SeDebugPrivilege privilege to execute arbitrary code as kernel an…
published 2004-12-31 21 y ago modified 2026-06-16 4 mo ago also EUVD-2004-2331
- cvss
- 8.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.4%
- EPSS 1.4% chance of exploitation in 30 days, percentile 73%
- public exploits
- 0
- none known
Summary
Microsoft Windows 2000, XP, and possibly 2003 allows local users with the SeDebugPrivilege privilege to execute arbitrary code as kernel and read or write kernel memory via the NtSystemDebugControl function, which does not verify its pointer arguments. Note: this issue has been disputed, since Administrator privileges are typically required to exploit this issue, thus privilege boundaries are not crossed
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
1.43% chance of exploitation in the next 30 days, higher than 73% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 8.4 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 8.4 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
References
-
securityfocus.com
/archive/1/354392
mailing-list, vendor-advisory
-
securitytracker.com
/id?1009128
vdb-entry
-
archives.neohapsis.com
/archives/bugtraq/2004-02/0529.html
mailing-list
-
archives.neohapsis.com
/archives/bugtraq/2004-02/0530.html
mailing-list
-
exchange.xforce.ibmcloud.com
/vulnerabilities/15263
vdb-entry
Sources
- CVE List CVE-2004-2339
- NVD CVE-2004-2339
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.