Vulnerability record · CVE-2005-1988 · published 10 August 2005
CVE-2005-1988: Internet Explorer JPEG rendering memory corruption RCE
Microsoft · Ie
Internet Explorer 5.0, 5.5 and 6.0 contain an unspecified memory corruption flaw triggered when rendering a crafted JPEG image. Because the image can be delivered via a web page or HTML e-mail, simply viewing attacker-controlled content can corrupt memory and potentially allow code execution. The record gives no root-cause detail beyond 'unknown vulnerability' and memory corruption.
Description
Unknown vulnerability in Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to execute arbitrary code via a web site or an HTML e-mail containing a crafted JPEG image that causes memory corruption, aka "JPEG Image Rendering Memory Corruption Vulnerability".
AV:N/AC:H/Au:N/C:P/I:P/A:P
Automated analysis
medium priorityThe flaw allows remote code execution with no authentication, but it affects only long-obsolete Internet Explorer versions and the record provides no evidence of active exploitation.
What it is
Internet Explorer 5.0, 5.5 and 6.0 contain an unspecified memory corruption flaw triggered when rendering a crafted JPEG image. Because the image can be delivered via a web page or HTML e-mail, simply viewing attacker-controlled content can corrupt memory and potentially allow code execution. The record gives no root-cause detail beyond 'unknown vulnerability' and memory corruption.
Impact
An attacker can execute arbitrary code in the context of the logged-on user, giving full control of the affected system if exploitation succeeds. The CVSS 2.0 vector rates confidentiality, integrity and availability impact as partial.
Attack surface
Reached remotely over the network via a malicious web site or an HTML e-mail containing the crafted JPEG; no authentication is required. The CVSS vector marks attack complexity as high, and the description implies the victim must view the image, so some user interaction is effectively needed.
Exploitation
Not listed in CISA KEV and no ransomware association is recorded, but EPSS is high at roughly 0.456 (98.7th percentile), indicating elevated predicted exploitation likelihood. Reference tags are limited to Patch and Vendor/US Government advisories, with no public exploit tag supplied.
What to do
- Apply the Microsoft security update for MS05-038 (the vendor patch referenced in the record) to all affected Internet Explorer 5.0, 5.5 and 6.0 installations.
- Upgrade to a supported, modern browser; Internet Explorer 5.x/6.0 are long out of support and receive no further fixes.
- Block or filter HTML e-mail and web content that renders untrusted JPEG images where operationally feasible.
- Enforce least privilege so users do not browse or read mail with administrative rights, limiting the value of successful code execution.
Detection
- Monitor for Internet Explorer processes spawning unexpected child processes such as cmd.exe or scripting hosts, which can indicate successful exploitation.
- Hunt for crash or memory-corruption events in iexplore.exe correlated with recently opened JPEG files or HTML e-mail attachments.
- Review proxy and mail gateway logs for delivery of JPEG-bearing HTML content from untrusted external sources to vulnerable hosts.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2005-1988 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2005-1988), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
