CVE-2005-2127: Internet Explorer COM Object Instantiation Memory Corruption

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 2.0 base score is 7.5 (HIGH) with network reachability and no authentication, and public exploit references exist, though the flaw affects only legacy Internet Explorer versions.

What it is

Internet Explorer 5.01, 5.5, and 6 can be made to instantiate COM objects not intended for use in the browser via embedded CLSIDs in a web page. This causes memory corruption, leading to application crash and possibly arbitrary code execution, as demonstrated with Msdds.dll and dozens of other listed objects.

Impact

An attacker can crash the browser and potentially execute arbitrary code in the context of the logged-on user. Successful code execution would give the attacker the user's privileges on the affected system.

Attack surface

Reached remotely over the network by luring a user to a malicious web page containing embedded CLSIDs; no authentication is required, but user interaction (visiting the page) is needed. The CVSS vector AV:N/AC:L/Au:N confirms network reachability with no authentication.

Exploitation

Not listed in CISA KEV, but EPSS is high (0.63665, 99.18th percentile) and multiple references carry the Exploit tag, indicating public exploit material exists. No ransomware group is documented as using it.

What to do

• Apply the Microsoft security update referenced in MS05-052 and the associated advisory 906267.
• Disable or restrict the affected COM objects (for example Msdds.dll) from being instantiated in Internet Explorer via kill bits or the registry.
• Upgrade to a supported browser that is not affected by this legacy COM instantiation issue.
• Restrict browsing to trusted sites and block untrusted ActiveX/COM content through IE security zones.

Detection

• Monitor for Internet Explorer processes loading the listed COM objects (Msdds.dll, Blnmgrps.dll, Ciodm.dll, Comsvcs.dll, and others) from unexpected paths.
• Alert on IE crashes correlated with visits to untrusted or newly seen web pages.
• Hunt for suspicious child processes spawned by iexplore.exe, which may indicate code execution following memory corruption.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.