Vulnerability record · CVE-2011-0096 · published 31 January 2011
CVE-2011-0096: Microsoft Windows MHTML Protocol Handler XSS via MIME-Formatted Request
Microsoft · Windows 2003 Server
The MHTML protocol handler in multiple Microsoft Windows versions fails to properly handle a MIME format in a request for content blocks in a document. This allows a remote attacker to conduct cross-site scripting (XSS) attacks through a crafted website visited in Internet Explorer. The flaw affects Windows XP, Server 2003, Vista, Server 2008, and Windows 7.
Description
The MHTML protocol handler in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle a MIME format in a request for content blocks in a document, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site that is visited in Internet Explorer, aka "MHTML Mime-Formatted Request Vulnerability."
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Automated analysis
high priorityPublic exploit code exists and EPSS score is very high (98.8th percentile), but the vulnerability requires user interaction and affects older, largely unsupported Windows versions.
What it is
The MHTML protocol handler in multiple Microsoft Windows versions fails to properly handle a MIME format in a request for content blocks in a document. This allows a remote attacker to conduct cross-site scripting (XSS) attacks through a crafted website visited in Internet Explorer. The flaw affects Windows XP, Server 2003, Vista, Server 2008, and Windows 7.
Impact
An attacker can execute script in the context of the victim's browser session, potentially stealing cookies, session tokens, or performing actions on behalf of the user. The CVSS 3.1 vector indicates low confidentiality and integrity impact with scope change.
Attack surface
The vulnerability is reached over the network by visiting a crafted website in Internet Explorer. User interaction is required (UI:R) and no authentication is needed (PR:N).
Exploitation
Exploit code is publicly available (Exploit-DB, 80vul reference). The CVE is not listed in CISA KEV, but EPSS probability is 0.468 (98.8th percentile), indicating high likelihood of exploitation activity.
What to do
- Apply the Microsoft security update MS11-026 (KB2501696) to affected Windows systems.
- Disable the MHTML protocol handler via registry if patching is not immediately possible.
- Restrict or block Internet Explorer usage on affected systems, or enforce Enhanced Security Configuration.
- Educate users about the risks of visiting untrusted websites and opening suspicious links.
- Monitor for and block known exploit delivery domains or patterns at the network perimeter.
Detection
- Monitor web proxy or IDS/IPS logs for requests containing 'mhtml:' or 'mhtml' URI schemes from internal hosts.
- Detect unusual script execution or cross-domain requests originating from Internet Explorer processes.
- Review Windows event logs for unexpected process creation or network connections from IE.
- Use endpoint detection to flag MHTML content being loaded from untrusted sources.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
6 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2011-0096 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2011-0096), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
