CVE-2003-0532
Internet Explorer 5.01 SP3 through 6.0 SP1 does not properly determine object types that are...
CVE-2003-0532 is a high vulnerability (CVSS 7.5) in Microsoft Internet Explorer, published August 22, 2003. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 23.0%, the 97th percentile. No source names a fixed version.
Internet Explorer 5.01 SP3 through 6.0 SP1 does not properly determine object types that are returned by web servers, which could allow remote attackers to execute arbitrary code via an object tag with a data parameter to a malicious file hosted on a server that returns an unsafe Content-Type, aka the "Object Type" vulnerability.
Exploit likelihood
What each source reports
NVD Score used
Internet Explorer 5.01 SP3 through 6.0 SP1 does not properly determine object types that are returned by web servers, which could allow remote attackers to execute arbitrary code via an object tag with a data parameter to a malicious file hosted on a server that returns an unsafe Content-Type, aka the "Object Type" vulnerability.
- Record
CVE-2003-0532- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Internet Explorer 5.01 SP3 through 6.0 SP1 does not properly determine object types that are returned by web servers, which could allow remote attackers to execute arbitrary code via an object tag with a data parameter to a malicious file hosted on a server that returns an unsafe Content-Type, aka the "Object Type" vulnerability.
- Record
CVE-2003-0532- Updated
- 2026-11-02
EUVDEUVD-2003-0526 No score
Internet Explorer 5.01 SP3 through 6.0 SP1 does not properly determine object types that are returned by web servers, which could allow remote attackers to execute arbitrary code via an object tag with a data parameter to a malicious file hosted on a server that returns an unsafe Content-Type, aka the "Object Type" vulnerability.
- Record
EUVD-2003-0526- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v4mq-xcq7-hmfv No score
Internet Explorer 5.01 SP3 through 6.0 SP1 does not properly determine object types that are...
Internet Explorer 5.01 SP3 through 6.0 SP1 does not properly determine object types that are returned by web servers, which could allow remote attackers to execute arbitrary code via an object tag with a data parameter to a malicious file hosted on a server that returns an unsafe Content-Type, aka the "Object Type" vulnerability.
- Record
GHSA-v4mq-xcq7-hmfv- Updated
- 2026-11-02
Affected products
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD |
References
kb.cert.org/vuls/id/865940
docs.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-032
eeye.com/html/Research/Advisories/AD20030820.html
archives.neohapsis.com/archives/vulnwatch/2003-q3/0084.html
marc.info?l=bugtraq&m=106149026621753&w=2
nvd.nist.gov/vuln/detail/CVE-2003-0532
github.com/advisories/GHSA-v4mq-xcq7-hmfv