What Was the Windows 95 CONCON Bug?

The Windows 95 CONCON bug was a notorious denial-of-service vulnerability that caused an immediate operating system crash whenever a specific path string was accessed. Originating from legacy device handling inherited from MS-DOS, the flaw allowed attackers to trigger a Blue Screen of Death (BSOD) locally or remotely by simply referencing the reserved console device name in a recursive directory format. This article explains the technical roots of the vulnerability, how it functioned, and its real-world impact on early internet users.

The Origin of the Bug

The CONCON bug was not an intentional feature, but rather an unintended software defect rooted in backward compatibility. In MS-DOS and early versions of Windows, certain hardware abstractions were assigned reserved keyword names. These included:

  • CON: The console (keyboard input and screen output)
  • PRN: The default printer
  • AUX: An auxiliary serial device
  • NUL: A null device (discards all data)

To maintain compatibility with older DOS software, Windows 95 and Windows 98 treated these keywords as globally reserved across the entire file system. Regardless of the directory path entered, if a file or folder matched a reserved device name, the operating system bypassed standard file lookup and directed the request to the corresponding hardware driver.

How the Vulnerability Worked

The flaw occurred when the operating system attempted to parse the console identifier nested within itself, most commonly written as C:\con\con or file:///c:/con/con.

When an application requested access to C:\con\con, the Windows file system driver processed the first \con as a valid access request for the hardware console. However, the parser then encountered the second \con treated as a sub-path. Because a hardware device cannot function as a directory or contain sub-items, the path traversal logic failed to handle the recursive reference.

Instead of gracefully returning a "Path Not Found" or "Invalid Request" error, the kernel entered an unhandled exception state. The underlying driver crashed, instantly triggering a Blue Screen of Death or freezing the system entirely, requiring a hard reboot.

Exploitation and Impact

The severity of the CONCON bug stemmed from how easily it could be executed without administrative privileges or direct console access. During the late 1990s and early 2000s, the flaw was weaponized across the internet:

  • Malicious Web Pages: Attackers embedded the path inside standard HTML tags, such as <img src="file:///c:/con/con">. When a Windows 95 or Windows 98 user visited the webpage via Internet Explorer, the browser attempted to load the image, immediately crashing the visitor's machine.
  • Chat Platforms: Users on IRC, ICQ, and early messaging platforms were tricked into clicking links or received messages that caused automated background lookups of the string.
  • Local Execution: Any local user could force an instant crash simply by typing c:\con\con into the "Run" dialog or addressing it in an MS-DOS prompt.

Resolution

The CONCON vulnerability remained unpatched for years after Windows 95 launched because it was initially viewed as an obscure quirk of legacy DOS path parsing. However, as internet connectivity expanded and remote exploitation surged, Microsoft addressed the issue in March 2000 by releasing a critical kernel update for Windows 95 and Windows 98. The patch modified the operating system's path parser to properly validate and reject invalid nested references to reserved hardware device names.