Vulnerability record · CVE-2004-0216 · published 3 November 2004
CVE-2004-0216: Internet Explorer Install Engine integer overflow enables remote code execution
Microsoft · Ie
The Install Engine (inseng.dll) in Internet Explorer 5.01, 5.5, and 6 contains an integer overflow when calculating a buffer length for a long .CAB file name. A malicious website or HTML email can trigger a heap-based buffer overflow. Successful exploitation allows arbitrary code execution in the context of the user.
Description
Integer overflow in the Install Engine (inseng.dll) for Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a malicious website or HTML email with a long .CAB file name, which triggers the integer overflow when calculating a buffer length and leads to a heap-based buffer overflow.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
critical priorityCVSS 2.0 base score of 10 with complete impact and remote, unauthenticated attack vector, though user interaction is required.
What it is
The Install Engine (inseng.dll) in Internet Explorer 5.01, 5.5, and 6 contains an integer overflow when calculating a buffer length for a long .CAB file name. A malicious website or HTML email can trigger a heap-based buffer overflow. Successful exploitation allows arbitrary code execution in the context of the user.
Impact
An attacker can execute arbitrary code with the privileges of the logged-on user, potentially leading to full system compromise. The CVSS 2.0 vector shows complete confidentiality, integrity, and availability impact.
Attack surface
The flaw is reached remotely over the network via a malicious website or HTML email containing a long .CAB file name. No authentication is required, but the victim must view the crafted content, so user interaction is needed.
Exploitation
The CVE is not listed in CISA KEV and has no ransomware associations. EPSS indicates a high probability of exploitation (0.48671, 98.8th percentile), and references include patch advisories but no public exploit tags.
What to do
- Apply the Microsoft security update MS04-038 or the latest cumulative IE patch for affected versions.
- Disable or restrict the Install Engine (inseng.dll) via Internet Explorer security zones or group policy where feasible.
- Block or filter .CAB file downloads and email attachments from untrusted sources.
- Upgrade to a supported, modern browser that no longer contains the vulnerable Install Engine.
Detection
- Monitor for unusual .CAB file names or long file name patterns in HTTP or email traffic.
- Detect crashes or heap corruption in inseng.dll via endpoint detection and response (EDR) or Windows Error Reporting.
- Review proxy or web logs for requests to known malicious sites hosting .CAB files targeting this vulnerability.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2004-0216 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2004-0216), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
