Vulnerability record · CVE-2005-0553 · published 2 May 2005
CVE-2005-0553: Microsoft Internet Explorer DHTML object processor race condition memory corruption
Microsoft · Ie
A race condition in the DHTML object processor's memory management routines in Internet Explorer 5.01, 5.5, and 6 allows remote attackers to corrupt memory and execute arbitrary code. Because the flaw is reachable from ordinary web content and HTML e-mail, it exposes any user browsing attacker-controlled pages on an unpatched system.
Description
Race condition in the memory management routines in the DHTML object processor in Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a malicious web page or HTML e-mail, aka "DHTML Object Memory Corruption Vulnerability".
AV:N/AC:H/Au:N/C:P/I:P/A:P
Automated analysis
high priorityRemote code execution reachable from web pages and e-mail with a high EPSS score, though exploitation is complicated by the race condition and the affected browser versions are long obsolete.
What it is
A race condition in the DHTML object processor's memory management routines in Internet Explorer 5.01, 5.5, and 6 allows remote attackers to corrupt memory and execute arbitrary code. Because the flaw is reachable from ordinary web content and HTML e-mail, it exposes any user browsing attacker-controlled pages on an unpatched system.
Impact
An attacker can execute arbitrary code in the context of the logged-on user, leading to full compromise of the client system. No privilege escalation beyond the user's own rights is described.
Attack surface
Reached over the network via a malicious web page or HTML e-mail rendered by Internet Explorer; the CVSS vector AV:N/AC:H/Au:N indicates no authentication is required but exploitation is difficult due to the race condition. User interaction (viewing the page or message) is implied by the delivery method.
Exploitation
Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is high at 0.506 (98.9th percentile), indicating elevated predicted exploitation activity.
What to do
- Apply Microsoft security bulletin MS05-020 (or the corresponding vendor patch) to affected Internet Explorer versions.
- Upgrade to a supported, modern browser and retire IE 5.01, 5.5, and 6 where possible.
- Disable or restrict HTML e-mail rendering and block untrusted web content for legacy IE users.
- Enforce network controls that limit access to untrusted sites from systems still running affected IE versions.
Detection
- Monitor for IE crashes or memory corruption events on hosts running IE 5.01, 5.5, or 6.
- Hunt for process creation or code execution originating from iexplore.exe following visits to untrusted sites or HTML e-mail.
- Review proxy and mail logs for delivery of suspicious HTML content to legacy IE clients.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2005-0553 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2005-0553), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
