Skip to content
Fencer Vulns
high 7.5

CVE-2003-0533 in the critical feed json

Stack-based buffer overflow in certain Active Directory service functions in LSASRV.DLL of the Local Security Authority Subsystem Service (…

published 2004-04-16 22 y ago modified 2026-06-16 4 mo ago also EUVD-2003-0527

cvss
7.5
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
85.6%
EPSS 85.6% chance of exploitation in 30 days, percentile 99.7%
public exploits
4
Metasploit, Exploit-DB

Summary

Stack-based buffer overflow in certain Active Directory service functions in LSASRV.DLL of the Local Security Authority Subsystem Service (LSASS) in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, XP SP1, Server 2003, NetMeeting, Windows 98, and Windows ME, allows remote attackers to execute arbitrary code via a packet that causes the DsRolerUpgradeDownlevelServer function to create long debug entries for the DCPROMO.LOG log file, as exploited by the Sasser worm.

Patch / fix

Timeline

  1. First public exploit (Metasploit exploit/windows/smb/ms04_011_lsass)
  2. Published

Exploit prediction

85.60% chance of exploitation in the next 30 days, higher than 99.7% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Metasploit exploit/windows/smb/ms04_011_lsass MS04-011 Microsoft LSASS Service DsRolerUpgradeDownlevelServer Overflow metasploit exploit, good rank, 2004-04-13
  • EDB-16368 Microsoft LSASS Service - DsRolerUpgradeDownlevelServer Overflow (MS04-011) (Metasploit) remote, 2010-07-03
  • EDB-295 Microsoft Windows XP/2000 - 'Lsasrv.dll' Remote Universal (MS04-011) remote, 2004-04-29
  • EDB-293 Microsoft Windows - 'Lsasrv.dll' RPC Remote Buffer Overflow (MS04-011) remote, 2004-04-24

CVSS scores

assigned by version score vector
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.