CVE-2004-0901: Microsoft Word for Windows 6.0 Converter (MSWRD632.WPC), as used in WordPad, does not properly validate cer...

Security readout for executives and security teams

This is an old Microsoft document-conversion flaw that could let an attacker run code when a user opens a malicious WordPad/Word document received by email or from a website. The main business risk is legacy Windows exposure where the vulnerable converter still exists or old patch baselines are incomplete. Likely exposure is limited to legacy Windows environments, archived virtual machines, unsupported endpoints, or systems retaining the MSWRD632.WPC converter. Modern managed fleets are less likely to be affected, but older document-processing workflows and dormant hosts should be checked. Treat this as a legacy exposure cleanup issue unless the organization still operates old Windows desktops or document-processing systems. If those exist, prioritize remediation because the impact is code execution from common document formats. Mitigation focus: Apply Microsoft MS04-041 guidance or confirm equivalent superseding patch coverage.; Inventory endpoints for the MSWRD632.WPC converter and legacy WordPad document handling.; Remove or disable vulnerable legacy converters where vendor guidance supports doing so..

Prepared

Jun 30, 2026, 02:08 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.