cbcvebase.
CVE-2005-4131
published 2005-12-09

CVE-2005-4131: Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute…

PriorityP341medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EXPLOIT
EPSS
31.11%
98.1th percentile
Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed range, which could lead to memory corruption involving an argument to the msvcrt.memmove function, aka "Brand new Microsoft Excel Vulnerability," as originally placed for sale on eBay as item number 7203336538.

Affected

5 ranges
VendorProductVersion rangeFixed in
microsoftexcel——
microsoftexcel——
microsoftexcel——
microsoftexcel——
microsoftexcel——

Detection & IOCsextracted from sources · hover to see the quote

bytes↗
00000760: 18 00 1b 00 00 00 00 05 07 ** ** 00 00 00 00 00 — setting ** to 0xFF triggers crash in Named Range definition
  • →Look for malformed Excel files (.xls) containing a corrupt 'Named Range' (NAME record) definition where the range boundary bytes are set to 0xFF — this triggers memory corruption via msvcrt.memmove and can indicate exploitation of CVE-2005-4131. ↗
  • →The proof-of-concept payload contains the ASCII string 'TEST1' (54 45 53 54 31) embedded in the Named Range record near offset 0x770 — scanning for this pattern in XLS binary streams may help identify PoC-derived samples. ↗
  • →The vulnerability manifests as an argument corruption to msvcrt.memmove — process-level monitoring for Excel spawning unexpected child processes or crashing after opening an XLS file with malformed range records is a strong behavioral indicator. ↗
  • ·The exact trigger bytes (marked '**' in the PoC) must be set to 0xFF to crash the application; the surrounding record structure is required context — the byte signature alone at offset 0x760 is not sufficient without the malformed Named Range record framing. ↗
  • ·Affected versions span Excel 95 through 2004 (multiple Office SKUs); detection rules should not be scoped to a single version — the malformed Named Range record is the common trigger across all affected versions. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.