CVE-2000-0259 in Windows
Summary
by MITRE
The default permissions for the Cryptography\Offload registry key used by the OffloadModExpo in Windows NT 4.0 allows local users to obtain compromise the cryptographic keys of other users.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 04/21/2026
The vulnerability identified as CVE-2000-0259 represents a critical access control flaw within the Windows NT 4.0 operating system that specifically targets the cryptographic subsystem. This weakness resides in the default registry permissions for the Cryptography\Offload key path, which is utilized by the OffloadModExpo component responsible for cryptographic operations. The issue stems from overly permissive default settings that grant unnecessary access rights to local user accounts, creating a pathway for privilege escalation and unauthorized cryptographic key access. The vulnerability affects systems running Windows NT 4.0 where the OffloadModExpo service is installed and active, potentially exposing sensitive cryptographic materials to unauthorized local users.
The technical implementation of this flaw involves the improper configuration of registry access control lists that govern the Cryptography\Offload registry key. This key serves as a storage location for cryptographic module information and key material used by the OffloadModExpo component, which is designed to handle cryptographic operations in a distributed manner. When default permissions are applied, local users may gain read access to this registry key, allowing them to extract cryptographic keys and other sensitive information that should remain protected. The vulnerability is classified under CWE-264 as "Permissions, Privileges, and Access Controls" and specifically relates to improper access control mechanisms within the Windows registry. This misconfiguration enables local users to bypass normal security boundaries that should protect cryptographic keys from unauthorized access, creating a significant risk to system security and data integrity.
The operational impact of CVE-2000-0259 extends beyond simple information disclosure, as it creates opportunities for more sophisticated attacks that can compromise the entire cryptographic infrastructure. Local users who exploit this vulnerability can potentially access cryptographic keys belonging to other users, enabling them to decrypt sensitive data, forge digital signatures, or impersonate legitimate users within the system. The attack vector is particularly concerning because it requires no elevated privileges to exploit, making it accessible to any local user account on the affected system. This vulnerability can be leveraged to perform credential theft, data exfiltration, and other malicious activities that undermine the fundamental security assumptions of the Windows NT 4.0 cryptographic framework. According to the MITRE ATT&CK framework, this vulnerability maps to the T1068 technique for "Exploitation for Privilege Escalation" and T1552 for "Unsecured Credentials," highlighting the multi-faceted nature of the threat. The impact is particularly severe in enterprise environments where Windows NT 4.0 systems may still be operational, as it can lead to widespread compromise of cryptographic assets across the organization.
Mitigation strategies for CVE-2000-0259 focus on correcting the registry permissions for the vulnerable key path and implementing proper access controls. System administrators should modify the registry permissions for the Cryptography\Offload key to restrict access to only authorized system components and administrators. This involves removing unnecessary read permissions for local user accounts and ensuring that only the OffloadModExpo service and system-level processes can access the key. The recommended approach includes implementing proper discretionary access control lists that align with the principle of least privilege, ensuring that cryptographic keys remain protected from unauthorized access. Additionally, organizations should consider upgrading from Windows NT 4.0 to more modern operating systems that provide better cryptographic security controls and have addressed similar vulnerabilities in their registry permission models. Regular security audits and monitoring of registry access patterns can help detect potential exploitation attempts, while maintaining up-to-date system patches and security configurations ensures that similar vulnerabilities are not present in the broader system infrastructure.