CVE-2003-0532

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 23.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2003-08-27 · updated 2026-06-16

Description

Internet Explorer 5.01 SP3 through 6.0 SP1 does not properly determine object types that are returned by web servers, which could allow remote attackers to execute arbitrary code via an object tag with a data parameter to a malicious file hosted on a server that returns an unsafe Content-Type, aka the "Object Type" vulnerability.

Affected products

Microsoft Ie: 6.0-sp1
Microsoft Internet Explorer 11: 5.0.1, 5.0.1-sp1, 5.0.1-sp2, 5.0.1-sp3, 5.5, 5.5-sp1 (+2)

References

http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0084.html
http://marc.info/?l=bugtraq&m=106149026621753&w=2
http://www.eeye.com/html/Research/Advisories/AD20030820.html
http://www.kb.cert.org/vuls/id/865940
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-032
http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0084.html
http://marc.info/?l=bugtraq&m=106149026621753&w=2
http://www.eeye.com/html/Research/Advisories/AD20030820.html
http://www.kb.cert.org/vuls/id/865940
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-032

Get alerted when CVE-2003-0532 or the next vulnerability affects your stack