Vulnerability record · CVE-2004-1043 · published 31 December 2004
CVE-2004-1043: Internet Explorer HTML Help ActiveX control cross-domain code execution
Microsoft · Internet Explorer
Internet Explorer 6.0 on Windows XP SP2 lets a remote attacker abuse the "Related Topics" command in the Help ActiveX control (hhctrl.ocx) to open a Help popup referencing the local-zone PCHealth tools.htm file, then inject JavaScript that runs in the local zone. This cross-domain flaw breaks IE's zone separation and enables arbitrary code execution in the context of the victim's machine.
Description
Internet Explorer 6.0 on Windows XP SP2 allows remote attackers to execute arbitrary code by using the "Related Topics" command in the Help ActiveX Control (hhctrl.ocx) to open a Help popup window containing the PCHealth tools.htm file in the local zone and injecting Javascript to be executed, as demonstrated using "writehta.txt" and the ADODB recordset, which saves a .HTA file to the local system, aka the "HTML Help ActiveX control Cross Domain Vulnerability."
AV:N/AC:L/Au:N/C:N/I:P/A:N
Automated analysis
high priorityThe flaw allows remote code execution with no authentication or interaction, and although the product is long obsolete, unpatched IE 6 on XP SP2 systems remain fully exposed.
What it is
Internet Explorer 6.0 on Windows XP SP2 lets a remote attacker abuse the "Related Topics" command in the Help ActiveX control (hhctrl.ocx) to open a Help popup referencing the local-zone PCHealth tools.htm file, then inject JavaScript that runs in the local zone. This cross-domain flaw breaks IE's zone separation and enables arbitrary code execution in the context of the victim's machine.
Impact
An attacker can execute arbitrary code on the victim's system, typically by writing a .HTA file to disk via the ADODB recordset and running it. This yields code execution at the user's privilege level, not just data disclosure.
Attack surface
Reached remotely over the network through a malicious web page or HTML content that invokes the Help ActiveX control; the CVSS vector (AV:N/AC:L/Au:N) indicates no authentication and no user interaction beyond loading the content. The flaw is in the client-side ActiveX control, so any browsing user is a target.
Exploitation
Not listed in CISA KEV and no ransomware associations are documented. EPSS is high (0.44984, 98.7th percentile), and references include US-CERT and CERT/CC advisories plus Microsoft bulletin MS05-001, indicating public technical detail and a vendor fix.
What to do
- Apply Microsoft security bulletin MS05-001 (the vendor fix for this issue) and any later cumulative IE updates.
- Disable or block the HTML Help ActiveX control (hhctrl.ocx) in IE where it is not required.
- Restrict browsing to trusted sites and enforce IE zone hardening so local-zone content cannot be reached from remote pages.
- Retire Internet Explorer 6.0 on Windows XP SP2; both are long out of support and cannot be safely maintained.
- Block execution of .HTA files and tighten ActiveX/scripting policy via group policy or application control.
Detection
- Monitor for hhctrl.ocx or Help ActiveX control instantiation from non-local or untrusted origins.
- Alert on creation of .HTA files in user-writable paths, especially those written by browser processes.
- Look for browser processes spawning scripting hosts (mshta.exe, wscript.exe, cscript.exe) or unusual child processes.
- Review proxy and web logs for pages referencing PCHealth tools.htm or the Related Topics Help command.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2004-1043 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2004-1043), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
