CVE-2002-0071: Microsoft Internet Information Server

High severity, CVSS 7.5. EPSS: 33.6% chance of exploitation in the next 30 days.

Buffer overflow in the ism.dll ISAPI extension that implements HTR scripting in Internet Information Server (IIS) 4.0 and 5.0 allows attackers to cause a denial of service or execute arbitrary code via HTR requests with long variable names.

Affected products

• Microsoft Internet Information Server: version 4.0 only
• Microsoft Internet Information Services: version 5.0 only

Published 2002-04-22. Last modified 2026-06-16.