CVE-2003-0660 in the critical feed json
The Authenticode capability in Microsoft Windows NT through Server 2003 does not prompt the user to download and install ActiveX controls w…
published 2003-10-17 23 y ago modified 2026-06-16 4 mo ago also EUVD-2003-0654
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 24.5%
- EPSS 24.5% chance of exploitation in 30 days, percentile 97%
- public exploits
- 0
- none known
Summary
The Authenticode capability in Microsoft Windows NT through Server 2003 does not prompt the user to download and install ActiveX controls when the system is low on memory, which could allow remote attackers to execute arbitrary code without user approval.
Patch / fix
- kb.cert.org/vuls/id/838572 advisory
- securityfocus.com/bid/8830 advisory
Exploit prediction
24.47% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
References
-
kb.cert.org
/vuls/id/838572
third-party-advisory, patch, us-government-resource
-
securityfocus.com
/bid/8830
vdb-entry, patch, vendor-advisory
-
docs.microsoft.com
/en-us/security-updates/securitybulletins/2003/ms03-041
vendor-advisory
-
cert.org
/advisories/CA-2003-27.html
third-party-advisory, us-government-resource
-
exchange.xforce.ibmcloud.com
/vulnerabilities/13422
vdb-entry
-
oval.cisecurity.org
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A198
vdb-entry, signature
-
oval.cisecurity.org
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A185
vdb-entry, signature
Sources
- CVE List CVE-2003-0660
- NVD CVE-2003-0660
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.