{"schemaVersion":3,"id":"CVE-2005-2127","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, as originally demonstrated using the (1) DDS Library Shape Control (Msdds.dll) COM object, and other objects including (2) Blnmgrps.dll, (3) Ciodm.dll, (4) Comsvcs.dll, (5) Danim.dll, (6) Htmlmarq.ocx, (7) Mdt2dd.dll (as demonstrated using a heap corruption attack with uninitialized memory), (8) Mdt2qd.dll, (9) Mpg4ds32.ax, (10) Msadds32.ax, (11) Msb1esen.dll, (12) Msb1fren.dll, (13) Msb1geen.dll, (14) Msdtctm.dll, (15) Mshtml.dll, (16) Msoeacct.dll, (17) Msosvfbr.dll, (18) Mswcrun.dll, (19) Netshell.dll, (20) Ole2disp.dll, (21) Outllib.dll, (22) Psisdecd.dll, (23) Qdvd.dll, (24) Repodbc.dll, (25) Shdocvw.dll, (26) Shell32.dll, (27) Soa.dll, (28) Srchui.dll, (29) Stobject.dll, (30) Vdt70.dll, (31) Vmhelper.dll, and (32) Wbemads.dll, aka a variant of the \"COM Object Instantiation Memory Corruption vulnerability.\"","dates":{"published":"2005-08-19T04:00:00.000Z","modified":"2024-08-07T22:15:37.364Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":7.5,"severity":"high","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.63665,"percentile":0.99213,"severity":"critical","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.63665},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.63665,"percentile":0.99213}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.63665,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.63665,"percentile":0.99213}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_EFE3040993D74332","name":"Exploit Reference (securityfocus.com)","source":"reference","url":"http://www.securityfocus.com/bid/14594","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"REF_44AC34D8ECBB4B11","name":"Exploit Reference (securitytracker.com)","source":"reference","url":"http://securitytracker.com/id?1014727","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"26167","name":"Microsoft Visual Studio .NET - 'msdds.dll' Remote Code Execution","source":"exploit-database","url":"https://www.exploit-db.com/exploits/26167","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"windows","file":"exploits/windows/remote/26167.pl","codes":["CVE-2005-2127","OSVDB-19093"]},"metasploit":null}],"exploitCount":3,"weaknesses":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer","description":"The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/119.html"}],"affected":[{"vendor":"microsoft","product":".net_framework","name":".net framework","label":".net_framework","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"1.1","noFixRecorded":false,"fixedIn":null},{"text":"1.1:sp1","noFixRecorded":false,"fixedIn":null},{"text":"1.1:sp2","noFixRecorded":false,"fixedIn":null},{"text":"1.1:sp3","noFixRecorded":false,"fixedIn":null}],"versionsText":"1.1 | 1.1:sp1 | 1.1:sp2 | 1.1:sp3","eol":null,"hubHref":"/vendor/microsoft/net_framework"},{"vendor":"microsoft","product":"office","name":"office","label":"office","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2000","noFixRecorded":false,"fixedIn":null},{"text":"2000:sp1","noFixRecorded":false,"fixedIn":null},{"text":"2000:sp2","noFixRecorded":false,"fixedIn":null},{"text":"2000:sp3","noFixRecorded":false,"fixedIn":null},{"text":"xp:sp1","noFixRecorded":false,"fixedIn":null},{"text":"xp:sp2","noFixRecorded":false,"fixedIn":null},{"text":"xp:sp3","noFixRecorded":false,"fixedIn":null}],"versionsText":"2000 | 2000:sp1 | 2000:sp2 | 2000:sp3 | xp:sp1 | xp:sp2 | xp:sp3","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"office","label":"Microsoft Office","category":"app"}},"hubHref":"/vendor/microsoft/office"},{"vendor":"microsoft","product":"project","name":"Project","label":"project","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"98","noFixRecorded":false,"fixedIn":null},{"text":"2000","noFixRecorded":false,"fixedIn":null},{"text":"2002","noFixRecorded":false,"fixedIn":null},{"text":"2002:sp1","noFixRecorded":false,"fixedIn":null},{"text":"2003","noFixRecorded":false,"fixedIn":null},{"text":"2003:sp1","noFixRecorded":false,"fixedIn":null}],"versionsText":"98 | 2000 | 2002 | 2002:sp1 | 2003 | 2003:sp1","eol":null,"hubHref":"/vendor/microsoft/project"},{"vendor":"microsoft","product":"visio","name":"visio","label":"visio","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2000:sr1","noFixRecorded":false,"fixedIn":null},{"text":"2002","noFixRecorded":false,"fixedIn":null},{"text":"2002:sp1","noFixRecorded":false,"fixedIn":null},{"text":"2002:sp2","noFixRecorded":false,"fixedIn":null},{"text":"2003","noFixRecorded":false,"fixedIn":null},{"text":"2003:sp1","noFixRecorded":false,"fixedIn":null}],"versionsText":"2000:sr1 | 2002 | 2002:sp1 | 2002:sp2 | 2003 | 2003:sp1","eol":null,"hubHref":"/vendor/microsoft/visio"},{"vendor":"microsoft","product":"visual_studio_.net","name":"visual studio .net","label":"visual_studio_.net","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2002:gold","noFixRecorded":false,"fixedIn":null},{"text":"2003","noFixRecorded":false,"fixedIn":null},{"text":"2003:gold","noFixRecorded":false,"fixedIn":null},{"text":"gold","noFixRecorded":false,"fixedIn":null}],"versionsText":"2002:gold | 2003 | 2003:gold | gold","eol":null,"hubHref":"/vendor/microsoft/visual_studio_net"}],"affectedCount":5,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://www.kb.cert.org/vuls/id/959049","label":"www.kb.cert.org/vuls/id/959049","hostname":"www.kb.cert.org","tags":["Third Party Advisory","X Refsource CERT VN","US Government Resource"]},{"url":"http://isc.sans.org/diary.php?date=2005-08-18","label":"isc.sans.org/diary.php?date=2005-08-18","hostname":"isc.sans.org","tags":["X Refsource MISC","Third Party Advisory"]},{"url":"http://www.securityfocus.com/archive/1/470690/100/0/threaded","label":"www.securityfocus.com/archive/1/470690/100/0/threaded","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ"]},{"url":"http://securityreason.com/securityalert/72","label":"securityreason.com/securityalert/72","hostname":"securityreason.com","tags":["Third Party Advisory","X Refsource SREASON"]},{"url":"http://support.avaya.com/elmodocs2/security/ASA-2005-214.pdf","label":"support.avaya.com/elmodocs2/security/ASA-2005-214.pdf","hostname":"support.avaya.com","tags":["X Refsource CONFIRM","Third Party Advisory"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA05-347A.html","label":"www.us-cert.gov/cas/techalerts/TA05-347A.html","hostname":"www.us-cert.gov","tags":["Third Party Advisory","X Refsource CERT","US Government Resource"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-052","label":"docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-052","hostname":"docs.microsoft.com","tags":["Vendor Advisory","X Refsource MS"]},{"url":"http://www.securityfocus.com/bid/15061","label":"www.securityfocus.com/bid/15061","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Third Party Advisory"]},{"url":"http://secunia.com/advisories/17223","label":"secunia.com/advisories/17223","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Permissions Required"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1454","label":"oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1454","hostname":"oval.cisecurity.org","tags":["VDB Entry","Signature","X Refsource OVAL"]},{"url":"http://secunia.com/advisories/16480","label":"secunia.com/advisories/16480","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Patch","Vendor Advisory"]},{"url":"http://www.microsoft.com/technet/security/advisory/906267.mspx","label":"www.microsoft.com/technet/security/advisory/906267.mspx","hostname":"www.microsoft.com","tags":["X Refsource MISC","Mitigation","Patch","Vendor Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/34754","label":"exchange.xforce.ibmcloud.com/vulnerabilities/34754","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF"]},{"url":"http://secunia.com/advisories/17172","label":"secunia.com/advisories/17172","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Permissions Required"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1538","label":"oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1538","hostname":"oval.cisecurity.org","tags":["VDB Entry","Signature","X Refsource OVAL"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/21895","label":"exchange.xforce.ibmcloud.com/vulnerabilities/21895","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1535","label":"oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1535","hostname":"oval.cisecurity.org","tags":["VDB Entry","Signature","X Refsource OVAL"]},{"url":"http://www.securityfocus.com/bid/14594","label":"www.securityfocus.com/bid/14594","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Exploit","Patch","Third Party Advisory"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1468","label":"oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1468","hostname":"oval.cisecurity.org","tags":["VDB Entry","Signature","X Refsource OVAL"]},{"url":"http://secunia.com/advisories/17509","label":"secunia.com/advisories/17509","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Permissions Required"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA06-220A.html","label":"www.us-cert.gov/cas/techalerts/TA06-220A.html","hostname":"www.us-cert.gov","tags":["Third Party Advisory","X Refsource CERT","US Government Resource"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1464","label":"oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1464","hostname":"oval.cisecurity.org","tags":["VDB Entry","Signature","X Refsource OVAL"]},{"url":"http://www.kb.cert.org/vuls/id/740372","label":"www.kb.cert.org/vuls/id/740372","hostname":"www.kb.cert.org","tags":["Third Party Advisory","X Refsource CERT VN","US Government Resource"]},{"url":"http://www.kb.cert.org/vuls/id/898241","label":"www.kb.cert.org/vuls/id/898241","hostname":"www.kb.cert.org","tags":["Third Party Advisory","X Refsource CERT VN","US Government Resource"]},{"url":"http://securitytracker.com/id?1014727","label":"securitytracker.com/id?1014727","hostname":"securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Exploit","Patch","Third Party Advisory","Vendor Advisory"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA05-284A.html","label":"www.us-cert.gov/cas/techalerts/TA05-284A.html","hostname":"www.us-cert.gov","tags":["Third Party Advisory","X Refsource CERT","US Government Resource"]},{"url":"http://www.vupen.com/english/advisories/2005/1450","label":"www.vupen.com/english/advisories/2005/1450","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Broken Link"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1155","label":"oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1155","hostname":"oval.cisecurity.org","tags":["VDB Entry","Signature","X Refsource OVAL"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2005-08-19T04:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-07T22:15:37.364Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":53,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T00:08:27.434Z","stale":false,"partial":false}}