The control for listing accessibility options in the Accessibility Utility Manager on Windows 2000 (ListView) does not properly handle Windows messages, which allows local users to execute arbitrary code via a "Shatter" style message to the Utility Manager that references a user-controlled callback function.

Threat-Mapped Scoring

Score: 1.8

Priority: P4 - Informational (Low)

• S9 – Sabotage of System/App

EPSS

Score: 0.00884
Percentile: 0.74442

CVSS Scoring

Affected Products

• cpe:2.3:o:microsoft:windows_2000:*:*:*:*:*:*:*:*
• cpe:2.3:o:microsoft:windows_2000:*:sp1:*:*:*:*:*:*
• cpe:2.3:o:microsoft:windows_2000:*:sp2:*:*:*:*:*:*
• cpe:2.3:o:microsoft:windows_2000:*:sp3:*:*:*:*:*:*

← Back to Home