A buffer overflow in Smart Card authentication code in gpkcsp.dll in Microsoft Windows XP through SP3 and Server 2003 through SP2 allows a…

Description

A buffer overflow in Smart Card authentication code in gpkcsp.dll in Microsoft Windows XP through SP3 and Server 2003 through SP2 allows a remote attacker to execute arbitrary code on the target computer, provided that the computer is joined in a Windows domain and has Remote Desktop Protocol connectivity (or Terminal Services) enabled.

Scores

EPSS (exploitation in 30 days)

45.8% · top 1.2% of all CVEs (2 Nov 2026)

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.1.

Weakness

• Buffer Overflow
• CWE-120 (opens in a new tab)

Affected products

• Microsoft · Microsoft Windows Server 2003 SP1, SP2 Windows XP - SP3

  • affected Microsoft Windows Server 2003 SP1, SP2 Windows XP - SP3

References (6)

• 98550 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• https://support.microsoft.com/en-us/help/4022747/security-update-for-windows-xp-and-windows-server-2003 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 98752 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• https://blog.fortinet.com/2017/05/11/deep-analysis-of-esteemaudit (opens in a new tab)x_refsource_MISCx_transferred
• https://blogs.technet.microsoft.com/msrc/2017/04/14/protecting-customers-and-evaluating-risk/ (opens in a new tab)x_refsource_MISCx_transferred
• https://blog.0patch.com/2017/06/a-quick-analysis-of-microsofts.html (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Record last updated 5 Aug 2024, 12:55 UTC.