CVE-2005-2947: Buffer overflow in KillProcess 2.20 and earlier allows user-assisted attackers to execute arbitrary code vi...

Security readout for executives and security teams

CVE-2005-2947 affects the legacy KillProcess utility, version 2.20 and earlier. A malicious executable with an overly long FileDescription metadata field can trigger a buffer overflow. The attacker still needs user assistance, so urgency depends on whether this old tool exists in your environment and handles untrusted executables. Exposure is likely limited to systems where KillProcess 2.20 or earlier is installed. Because the product is old and niche, many environments will have no exposure, but security teams should verify legacy admin tool inventories rather than assume absence. Treat this as a targeted legacy exposure check, not an enterprise-wide emergency. Prioritize removal or replacement if KillProcess 2.20 or earlier is found on administrator workstations or systems that process untrusted files. Mitigation focus: Inventory endpoints for KillProcess installations and identify versions at or below 2.20.; Remove KillProcess where there is no current operational need.; Check vendor or trusted archival guidance for a fixed or safer replacement version..

Prepared

Jun 29, 2026, 17:57 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.