CVE-2005-4717: Microsoft Ie

Medium severity, CVSS 5.0. EPSS: 16.3% chance of exploitation in the next 30 days.

Microsoft Internet Explorer 6.0 on Windows NT 4.0 SP6a, Windows 2000 SP4, Windows XP SP1, Windows XP SP2, and Windows Server 2003 SP1 allows remote attackers to cause a denial of service (client crash) via a certain combination of a malformed HTML file and a CSS file that triggers a null dereference, probably related to rendering of a DIV element that contains a malformed IMG tag, as demonstrated by IEcrash.htm and IEcrash.rar.

Affected products

• Microsoft Ie: version 6.0 only
• Microsoft Internet Explorer: version 6.0 only
• Microsoft Windows 2000: any version
• Microsoft Windows 2003 Server: version sp1 only
• Microsoft Windows Nt: version 4.0 only
• Microsoft Windows XP: any version

Published 2005-12-31. Last modified 2026-06-16.