CVE-2005-0054: Microsoft Ie

Medium severity, CVSS 5.1. EPSS: 24.3% chance of exploitation in the next 30 days.

Internet Explorer 5.01, 5.5, and 6 allows remote attackers to spoof a less restrictive security zone and execute arbitrary code via an HTML page containing URLs that contain hostnames that have been double hex encoded, which are decoded twice to generate a malicious hostname, aka the "URL Decoding Zone Spoofing Vulnerability."

Affected products

• Microsoft Ie: version 6 only
• Microsoft Internet Explorer: version 5.01 only; version 5.5 only

Published 2005-05-02. Last modified 2026-06-16.