CVE-2005-4269
HighSummary
A vulnerability in mshtml.dll of Microsoft Windows XP, Server 2003, and Internet Explorer 6.0 SP1 allows attackers to cause a denial of service (access violation) by processing button-focus events simultaneously with document reloading, as observed in Microsoft Office InfoPath 2003 when repeatedly clicking the 'Delete' button in a repeating section of a form.
Risk Assessment
The risk to organizations is low as the attack requires local user interaction and does not violate privilege boundaries. In practice, the vulnerability may cause temporary application unavailability but not privilege escalation or data leakage.
Recommendation
It is recommended to update Windows and Internet Explorer to the latest versions via Windows Update. For InfoPath 2003 users, consider limiting user interaction with repeating form sections.
Related vulnerabilities
- CVE-2026-115812Critical
A relative path traversal during model archive extraction in AWS Multi Model Server 1.1.11 and earlier allows remote actors to execute arbitrary code via a crafted model archive. The project is end of life and no fixed version is available.
- CVE-2026-55486Critical
In Goobi viewer from version 25.08 to before 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token accept an origin query parameter without validation and embed it into the Content-Security-Policy header and an HTML response body as a postMessage argument. Since the attacker controls both calls, the unescaped value yields reflected XSS.
- CVE-2026-53942Critical
In conda/conda prior to commit 9c0f238, a GitHub Actions Pwn Request vulnerability remains in .github/workflows/update.yml. It is triggered by comments containing @conda-bot render or @conda-bot recreate, allowing an untrusted PR to reach Jinja2 template rendering in a privileged token context.
- CVE-2026-46652Critical
In Goobi viewer from version 24.03 to before 26.05, ExternalFilesDownloader.getFilename() extracts the filename from a server-supplied Content-Disposition header and passes it directly to Path.resolve() without stripping directory components. A malicious HTTP server can supply an absolute path or ../ sequences, writing attacker-controlled content to an arbitrary path, leading to remote code execution.
- CVE-2026-46651Critical
In Goobi viewer from version 24.03 to before 26.05, the DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket) in goobi-viewer-core accepts download requests from unauthenticated users. This issue has been patched in version 26.05.
- CVE-2026-53921Critical
In odhcpd (the DHCPv6/DHCPv4/RA server used by OpenWrt) prior to version 25.12, the DHCPv6 IA response handler writes past a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two independent overflow sites exist in the same call chain, both reachable over the network via a single unauthenticated UDP packet. odhcpd runs as root on OpenWrt, and embedded targets often lack stack canaries and ASLR, making code execution realistic.
- CVE-2026-114357Critical
In DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9, the Android Debug Bridge daemon (adbd) lacks authentication for a critical function. The device ships with ro.adb.secure=0 and USB ADB enabled by default; once ADB over TCP is enabled, the same unauthenticated shell (uid 2000) is reachable over the network. This provides a foothold for privilege escalation to root.
- CVE-2026-57116Critical
In PraisonAI from version 4.2.1 to before 4.6.59, the AgentOS FastAPI deployment surface remains unauthenticated despite the earlier fix for CVE-2026-40151. The chat route directly calls agent.chat(request.message), and both no-auth and wrong-bearer requests execute the deployed agent.
- CVE-2026-112859Critical
The Little Birdies WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Little Birdies from n/a through 1.3.16.
- CVE-2026-112858Critical
The Rhodos WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Rhodos from n/a through 1.3.3.
Original NVD description (English source)
mshtml.dll in Microsoft Windows XP, Server 2003, and Internet Explorer 6.0 SP1 allows attackers to cause a denial of service (access violation) by causing mshtml.dll to process button-focus events at the same time that a document is reloading, as seen in Microsoft Office InfoPath 2003 by repeatedly clicking the "Delete" button in a repeating section in a form. NOTE: the normal operation of InfoPath appears to involve a local user without any privilege boundaries, so this might not be a vulnerability in InfoPath. If no realistic scenarios exist for this problem in other products, then perhaps it should be excluded from CVE.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS