CVE-2005-1208: Windows HTML Help integer overflow enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityThe flaw allows unauthenticated remote code execution with a 10.0 CVSS score and very high EPSS, but it affects only long-unsupported legacy Windows versions, lowering real-world exposure.

What it is

A crafted compiled Help (.CHM) file with an oversized size field triggers an integer overflow and heap-based buffer overflow in Microsoft Windows HTML Help handling. Because the flaw is reachable through Internet Explorer via an ms-its: URL, simply viewing attacker-controlled content can run code on the host. The affected platforms are legacy Windows releases (98, 2000, XP SP2 and earlier, Server 2003 SP1 and earlier).

Impact

An unauthenticated remote attacker can execute arbitrary code with the privileges of the logged-on user, giving full control of confidentiality, integrity and availability on the target. No privilege escalation is needed beyond the victim's own account context.

Attack surface

Reached over the network through a crafted CHM file or an ms-its: URL rendered in Internet Explorer; the CVSS vector AV:N/AC:L/Au:N indicates no authentication is required. User interaction is implied by the browser-delivered vector but is not explicitly stated in the record.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is 0.4733 (98.8th percentile), indicating a high modeled likelihood of exploitation. References are patch and advisory material only, with no public exploit tag.

What to do

• Apply the Microsoft MS05-026 security update on all affected Windows versions; this is the primary fix.
• Retire or isolate unsupported platforms (Windows 98, 2000, XP SP2 and earlier, Server 2003 SP1 and earlier) that cannot receive current patches.
• Block or restrict ms-its: and related HTML Help URL handling in Internet Explorer and email clients where feasible.
• Prevent untrusted CHM files from being opened or downloaded, and filter CHM attachments at mail and web gateways.
• Reduce user privileges so successful exploitation yields limited account rights rather than administrative control.

Detection

• Monitor for ms-its: URL invocations and CHM file opens originating from browser or email processes.
• Alert on heap corruption or buffer overflow crash signatures in HTML Help (hh.exe) or Internet Explorer processes.
• Hunt for unexpected child processes spawned by hh.exe or iexplore.exe, which may indicate code execution.
• Track CHM files written to user download or temp directories from external sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.