$ cve CVE-2005-1990 JSON

CVE-2005-1990 EXPLOIT

5.1

MEDIUM · CVSS 2.0 · EPSS 48.5% (pctl 99)

Patch early

A public exploit exists.

Description

Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not ActiveX controls, including (1) devenum.dll, (2) diactfrm.dll, (3) wmm2filt.dll, (4) fsusd.dll, (5) dmdskmgr.dll, (6) browsewm.dll, (7) browseui.dll, (8) shell32.dll, (9) mshtml.dll, (10) inetcfg.dll, (11) infosoft.dll, (12) query.dll, (13) syncui.dll, (14) clbcatex.dll, (15) clbcatq.dll, (16) comsvcs.dll, and (17) msconf.dll, which causes memory corruption, aka "COM Object Instantiation Memory Corruption Vulnerability," a different vulnerability than CVE-2005-2087.

Scoring

CVSS	5.1 (MEDIUM, v2.0)
Vector	AV:N/AC:H/Au:N/C:P/I:P/A:P
EPSS	48.51% — more likely to be exploited than 99% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2005-08-10
Last modified	2026-06-16

Affected (2)

Vendor	Product
microsoft	ie
microsoft	internet explorer

Public exploits

Source	Title	Date
exploit-db	Microsoft Internet Explorer - 'blnmgr.dll' COM Object Remote (MS05-038)	2005-08-09

References

→ the Explorer · watch your stack · NVD