$ cve CVE-2004-0842 JSON

CVE-2004-0842 EXPLOIT

7.5

HIGH · CVSS 2.0 · EPSS 56.6% (pctl 99)

Patch early

A public exploit exists.

Description

Internet Explorer 6.0 SP1 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (application crash from "memory corruption") via certain malformed Cascading Style Sheet (CSS) elements that trigger heap-based buffer overflows, as demonstrated using the "<STYLE>@;/*" string, possibly due to a missing comment terminator that may cause an invalid length to trigger a large memory copy operation, aka the "CSS Heap Memory Corruption Vulnerability."

Scoring

CVSS	7.5 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS	56.61% — more likely to be exploited than 99% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2004-12-23
Last modified	2026-06-16

Affected (7)

Vendor	Product
avaya	definity one media server
avaya	ip600 media servers
avaya	modular messaging message storage server
avaya	s3400
avaya	s8100
microsoft	ie
microsoft	internet explorer

Public exploits

Source	Title	Date
exploit-db	Microsoft Internet Explorer 5.0.1 - Style Tag Comment Memory Corruption	2004-07-08

References

→ the Explorer · watch your stack · NVD