CVE-2005-4840: Microsoft Outlook Express Book Control

Medium severity, CVSS 4.3. EPSS: 11.5% chance of exploitation in the next 30 days.

The Outlook Express Address Book control, when using Internet Explorer 6, allows remote attackers to cause a denial of service (NULL dereference and browser crash) by creating the OutlookExpress.AddressBook COM object, which is not intended for use within Internet Explorer.

Affected products

• Microsoft Outlook Express Book Control: any version

Published 2005-12-31. Last modified 2026-06-16.