CVE-2002-1185: Microsoft Ie

Medium severity, CVSS 5.0. EPSS: 21.3% chance of exploitation in the next 30 days.

Internet Explorer 5.01 through 6.0 does not properly check certain parameters of a PNG file when opening it, which allows remote attackers to cause a denial of service (crash) by triggering a heap-based buffer overflow using invalid length codes during decompression, aka "Malformed PNG Image File Failure."

Affected products

• Microsoft Ie: version 6.0 only
• Microsoft Internet Explorer: version 5.0.1 only; version 5.5 only; version 6.0 only

Published 2002-12-11. Last modified 2026-06-16.