CVE-2005-1990: Internet Explorer COM object instantiation memory corruption

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

medium priorityThe flaw allows remote memory corruption with possible code execution, but it affects only legacy IE versions, requires high attack complexity, and has no KEV listing or documented exploit.

What it is

Internet Explorer 5.0, 5.5 and 6.0 mishandle instantiation of CLSIDs that reference COM objects which are not ActiveX controls, including devenum.dll, shell32.dll, mshtml.dll and others. A crafted web page can trigger memory corruption, crashing the browser and possibly allowing code execution. The record does not state affected patch levels or whether public exploit code exists.

Impact

An attacker can crash the browser and potentially execute arbitrary code in the context of the logged-on user. Successful code execution would give the attacker the user's privileges on the workstation.

Attack surface

Reached by a remote attacker hosting a malicious web page that the victim opens in Internet Explorer; no authentication is required. The CVSS vector AV:N/AC:H/Au:N indicates network delivery with high attack complexity and no user credentials, though the description implies the victim must load the page.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented. EPSS is 0.48513 (98.8th percentile), suggesting elevated predicted activity, but the references carry only Patch, Vendor Advisory and US Government Resource tags, with no exploit or proof-of-concept tags.

What to do

• Apply Microsoft security bulletin MS05-038 (the vendor patch referenced for this issue) to affected Internet Explorer installations.
• Upgrade or retire Internet Explorer 5.0, 5.5 and 6.0, which are long out of support; migrate users to a supported browser.
• Restrict browsing to trusted sites and block untrusted ActiveX/COM object instantiation through IE security zones and kill-bit controls where feasible.
• Disable or remove unnecessary COM objects named in the advisory (for example devenum.dll, mshtml.dll, shell32.dll) from the browser attack path.
• Run users with least privilege so any code execution is limited to the user's rights.

Detection

• Monitor for IE crashes (Application Error / faulting module mshtml.dll, browseui.dll, shell32.dll) correlated with visits to untrusted sites.
• Alert on browser processes spawning unexpected child processes or writing executables after a page load.
• Review proxy and DNS logs for known malicious or exploit-hosting domains visited by IE clients.
• Use host-based monitoring for COM object instantiation anomalies from browser processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.