Vulnerability record · CVE-2005-1790 · published 1 June 2005
CVE-2005-1790: Internet Explorer 6 memory corruption via JavaScript BODY onload window call
Microsoft · Internet Explorer
Internet Explorer 6 SP2 and earlier versions contain a memory corruption flaw triggered by a JavaScript BODY onload event that calls the window function, described as a mismatched Document Object Model objects issue. A remote attacker can crash the browser and potentially execute arbitrary code in the context of the user. The record is old and thin on technical detail, but it is a browser memory corruption bug with code execution potential.
Description
Microsoft Internet Explorer 6 SP2 6.0.2900.2180 and 6.0.2800.1106, and earlier versions, allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a Javascript BODY onload event that calls the window function, aka "Mismatched Document Object Model Objects Memory Corruption Vulnerability."
AV:N/AC:H/Au:N/C:N/I:N/A:P
Automated analysis
medium priorityThe flaw allows remote code execution and has very high EPSS, but it affects a long-obsolete browser and the CVSS 2.0 score is only 2.6 with no KEV listing.
What it is
Internet Explorer 6 SP2 and earlier versions contain a memory corruption flaw triggered by a JavaScript BODY onload event that calls the window function, described as a mismatched Document Object Model objects issue. A remote attacker can crash the browser and potentially execute arbitrary code in the context of the user. The record is old and thin on technical detail, but it is a browser memory corruption bug with code execution potential.
Impact
An attacker can cause a denial of service by crashing Internet Explorer and may be able to execute arbitrary code with the privileges of the logged-on user. The CVSS 2.0 vector scores only partial availability impact, so the code execution claim is not reflected in the score.
Attack surface
Reached over the network by a victim loading a crafted web page or HTML email containing the malicious JavaScript BODY onload handler; no authentication is required, but the CVSS vector rates access complexity as high and user interaction is implied by browsing to attacker-controlled content.
Exploitation
Not listed in CISA KEV and no ransomware associations are documented; EPSS is high at 0.83472 (99.667th percentile), but the reference tags are only vendor advisories and government resources, with no public exploit tag in this record.
What to do
- Apply the Microsoft security update referenced in MS05-054, which addresses this vulnerability.
- Upgrade from Internet Explorer 6 to a supported, current browser.
- Disable or restrict JavaScript execution in Internet Explorer where legacy use is unavoidable.
- Block or filter untrusted web content and email HTML that can invoke the affected handler.
Detection
- Monitor for Internet Explorer crash reports (faulting module mshtml/IE) correlated with visits to untrusted sites.
- Search proxy and web logs for pages containing BODY onload handlers calling window functions from untrusted origins.
- Review endpoint telemetry for unexpected child processes spawned by iexplore.exe, which would suggest code execution beyond a simple crash.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2005-1790 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2005-1790), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
