CVE-2005-4269
HighSummary
A vulnerability in mshtml.dll of Microsoft Windows XP, Server 2003, and Internet Explorer 6.0 SP1 allows attackers to cause a denial of service (access violation) by processing button-focus events simultaneously with document reloading, as observed in Microsoft Office InfoPath 2003 when repeatedly clicking the 'Delete' button in a repeating section of a form.
Risk Assessment
The risk to organizations is low as the attack requires local user interaction and does not violate privilege boundaries. In practice, the vulnerability may cause temporary application unavailability but not privilege escalation or data leakage.
Recommendation
It is recommended to update Windows and Internet Explorer to the latest versions via Windows Update. For InfoPath 2003 users, consider limiting user interaction with repeating form sections.
Related vulnerabilities
- CVE-2026-75430Critical
PowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport port, allowing a remote attacker to execute arbitrary code.
- CVE-2026-75431Critical
PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for HS256-based authentication, allowing a remote attacker to execute arbitrary code.
- CVE-2026-44402Critical
Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in the upload.cgi firmware update endpoint, allowing remote attackers to execute arbitrary commands as root by uploading a crafted tar archive.
- CVE-2026-19274Critical
IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated Kubernetes tenant to hijack or permanently destroy another tenant's cluster-level RBAC permissions, caused by cluster-scoped RBAC objects keyed solely by the bare CR name with no namespace disambiguation.
- CVE-2026-18658Critical
IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in remote code execution.
- CVE-2026-85696Critical
SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded audio filenames are interpolated into ffmpeg commands without proper escaping. Attackers can upload audio files with shell metacharacters in the filename to break out of quoted arguments and execute arbitrary system commands when video generation occurs.
- CVE-2026-85695Critical
FastChat contains an authentication bypass vulnerability in the /register_worker endpoint that allows unauthenticated attackers to register arbitrary worker addresses and perform server-side request forgery. Attackers can register malicious workers under victim model names to intercept user prompts, images, and responses, or probe internal network ports.
- CVE-2026-85688Critical
TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in the TMAN Designer file-content API endpoints. Attackers can submit POST and PUT requests to read arbitrary files or write malicious content to system paths, enabling code execution.
- CVE-2026-85684Critical
marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler that fails to sanitize the file.filename parameter. Unauthenticated attackers can supply filenames with directory traversal sequences to write arbitrary files or delete existing files.
- CVE-2026-85672Critical
zerox 1.1.20 contains an OS command injection vulnerability in the file download mechanism where the temporary file extension derived from document URLs is interpolated unsanitized into shell commands. Attackers can craft URLs with malicious extensions to execute arbitrary OS commands.
Original NVD description (English source)
mshtml.dll in Microsoft Windows XP, Server 2003, and Internet Explorer 6.0 SP1 allows attackers to cause a denial of service (access violation) by causing mshtml.dll to process button-focus events at the same time that a document is reloading, as seen in Microsoft Office InfoPath 2003 by repeatedly clicking the "Delete" button in a repeating section in a form. NOTE: the normal operation of InfoPath appears to involve a local user without any privilege boundaries, so this might not be a vulnerability in InfoPath. If no realistic scenarios exist for this problem in other products, then perhaps it should be excluded from CVE.