Windows GDI+ JPEG Vulnerability (MS04-028) Explained

In September 2004, Microsoft disclosed a critical remote code execution flaw in its Graphics Device Interface Plus (GDI+) library, tracked as CVE-2004-0200 and documented in security bulletin MS04-028. The flaw allowed malicious actors to compromise a target machine simply by getting the user to view a specially crafted JPEG image. This article breaks down the technical mechanism behind the vulnerability, its attack vectors, the scope of its impact, and how it was resolved.

The Technical Mechanism

The vulnerability stemmed from a heap-based buffer overflow within Gdiplus.dll, the core library responsible for handling two-dimensional vector graphics, imaging, and typography in modern Windows operating systems.

When parsing JPEG files, the library processed variable-length metadata markers, such as the JPEG Comment (COM) marker (defined by the byte sequence 0xFFFE). GDI+ read the length field specified in the marker, allocated a memory buffer based on that value, and copied the payload into memory. However, the parser failed to properly validate the specified size against the actual data stream. By supplying a malformed length value, an attacker could trigger a heap overflow, overwriting adjacent memory space and redirecting program execution flow to inject and run arbitrary shellcode.

Attack Vectors and Exploitation

Because GDI+ was deeply integrated into the operating system and user applications, the attack surface was massive. A victim did not need to run an executable file to be infected; passive rendering of an image was sufficient.

Common exploitation vectors included:

• Web Browsing: An attacker could host the corrupted JPEG on a website. When a user visited the page using Internet Explorer, the browser automatically parsed the image, triggering the exploit.
• Email: If a malicious image was embedded in an HTML email or included as an attachment, viewing or previewing the message in Microsoft Outlook or Outlook Express would execute the payload.
• File Browsing: Opening a folder containing the malformed JPEG in Windows Explorer could trigger the vulnerability if thumbnail view was enabled, as the shell rendered previews automatically.

The malicious code executed with the privileges of the active user, allowing attackers to install malware, modify files, or create administrative accounts if the victim had administrator rights.

The Pervasiveness of the Flaw

MS04-028 was particularly disruptive because GDI+ was not confined to a single system directory. While it was native to Windows XP and Windows Server 2003, Microsoft had also distributed Gdiplus.dll alongside numerous standalone software packages for older platforms like Windows 2000 and Windows 98.

Applications such as Microsoft Office XP, Office 2003, Visual Studio .NET, and Internet Explorer 6 shipped their own local versions of the library. Furthermore, third-party software developers frequently bundled Gdiplus.dll directly within their application directories. This decentralization meant that patching the operating system alone was insufficient to secure a machine, as individual application copies remained vulnerable.

Mitigation and Legacy

Microsoft released security bulletin MS04-028 to patch the parsing routine inside Gdiplus.dll, ensuring strict bounds checking during JPEG decoding. To address the issue of isolated, application-specific copies of the DLL, Microsoft also released the GDI+ Detection Tool to help administrators scan their hard drives and locate unpatched versions of the file.

The 2004 GDI+ JPEG vulnerability represented a turning point in image-parsing security, highlighting that non-executable media files could serve as reliable vehicles for full system compromise. It spurred Microsoft to accelerate the adoption of stronger memory protections and centralized DLL management in subsequent Windows releases.