CVE-2004-0978

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 38.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2004-10-21 · updated 2026-06-16
Weakness: CWE-787

Description

Heap-based buffer overflow in the Hrtbeat.ocx (Heartbeat) ActiveX control for Internet Explorer 5.01 through 6, when users who visit online gaming sites that are associated with MSN, allows remote attackers to execute arbitrary code via the SetupData parameter.

Affected products

Microsoft Internet Explorer 11: 5.01-sp3, 5.01-sp4, 5.5-sp2, 6, 6-sp1

References

http://marc.info/?l=bugtraq&m=110616221411579&w=2
http://www.kb.cert.org/vuls/id/673134
http://www.ngssoftware.com/advisories/heartbeatfull.txt
http://www.securityfocus.com/bid/11367
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-038
https://exchange.xforce.ibmcloud.com/vulnerabilities/17714
http://marc.info/?l=bugtraq&m=110616221411579&w=2
http://www.kb.cert.org/vuls/id/673134
http://www.ngssoftware.com/advisories/heartbeatfull.txt
http://www.securityfocus.com/bid/11367
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-038
https://exchange.xforce.ibmcloud.com/vulnerabilities/17714

Get alerted when CVE-2004-0978 or the next vulnerability affects your stack