CVE-2003-0532 in the critical feed json
Internet Explorer 5.01 SP3 through 6.0 SP1 does not properly determine object types that are returned by web servers, which could allow rem…
published 2003-08-22 23 y ago modified 2026-06-16 4 mo ago also EUVD-2003-0526
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 23.0%
- EPSS 23.0% chance of exploitation in 30 days, percentile 97%
- public exploits
- 0
- none known
Summary
Internet Explorer 5.01 SP3 through 6.0 SP1 does not properly determine object types that are returned by web servers, which could allow remote attackers to execute arbitrary code via an object tag with a data parameter to a malicious file hosted on a server that returns an unsafe Content-Type, aka the "Object Type" vulnerability.
Exploit prediction
22.96% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- archives.neohapsis.com http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0084.html referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
References
-
archives.neohapsis.com
/archives/vulnwatch/2003-q3/0084.html
mailing-list, exploit, vendor-advisory
-
docs.microsoft.com
/en-us/security-updates/securitybulletins/2003/ms03-032
vendor-advisory
-
kb.cert.org
/vuls/id/865940
third-party-advisory, us-government-resource
- eeye.com /html/Research/Advisories/AD20030820.html
-
marc.info
/?l=bugtraq&m=106149026621753&w=2
mailing-list
Sources
- CVE List CVE-2003-0532
- NVD CVE-2003-0532
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.