CVE-2003-0532
Internet Explorer 5.01 SP3 through 6.0 SP1 does not properly determine object types that are...
Internet Explorer 5.01 SP3 through 6.0 SP1 does not properly determine object types that are returned by web servers, which could allow remote attackers to execute arbitrary code via an object tag with a data parameter to a malicious file hosted on a server that returns an unsafe Content-Type, aka the "Object Type" vulnerability.
Exploit likelihood
What each source reports
NVD Score used
Internet Explorer 5.01 SP3 through 6.0 SP1 does not properly determine object types that are returned by web servers, which could allow remote attackers to execute arbitrary code via an object tag with a data parameter to a malicious file hosted on a server that returns an unsafe Content-Type, aka the "Object Type" vulnerability.
- Record
CVE-2003-0532- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Internet Explorer 5.01 SP3 through 6.0 SP1 does not properly determine object types that are returned by web servers, which could allow remote attackers to execute arbitrary code via an object tag with a data parameter to a malicious file hosted on a server that returns an unsafe Content-Type, aka the "Object Type" vulnerability.
- Record
CVE-2003-0532- Updated
- 2026-11-02
EUVDEUVD-2003-0526 No score
Internet Explorer 5.01 SP3 through 6.0 SP1 does not properly determine object types that are returned by web servers, which could allow remote attackers to execute arbitrary code via an object tag with a data parameter to a malicious file hosted on a server that returns an unsafe Content-Type, aka the "Object Type" vulnerability.
- Record
EUVD-2003-0526- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v4mq-xcq7-hmfv No score
Internet Explorer 5.01 SP3 through 6.0 SP1 does not properly determine object types that are...
Internet Explorer 5.01 SP3 through 6.0 SP1 does not properly determine object types that are returned by web servers, which could allow remote attackers to execute arbitrary code via an object tag with a data parameter to a malicious file hosted on a server that returns an unsafe Content-Type, aka the "Object Type" vulnerability.
- Record
GHSA-v4mq-xcq7-hmfv- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2003-0532 is a high vulnerability (CVSS 7.5) in Microsoft Internet Explorer, published August 22, 2003. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 23.0%, the 97th percentile. No source names a fixed version.
References
kb.cert.org/vuls/id/865940
docs.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-032
eeye.com/html/Research/Advisories/AD20030820.html
archives.neohapsis.com/archives/vulnwatch/2003-q3/0084.html
marc.info?l=bugtraq&m=106149026621753&w=2
nvd.nist.gov/vuln/detail/CVE-2003-0532
github.com/advisories/GHSA-v4mq-xcq7-hmfv