CVE-2003-0838

CVE-2003-0838 describes a critical vulnerability in Microsoft Internet Explorer 5 and 6, allowing remote attackers to bypass security zone restrictions. Attackers could inject and execute arbitrary programs by crafting a popup window containing malicious ActiveX object code, which IE would mistakenly process as an HTA application. This flaw carried a CVSS score of 7.5, indicating high severity with easy exploitation and potential for complete compromise of confidentiality, integrity, and availability. While not listed on the KEV catalog, exploit code was publicly available (EDB-23114), and it was notably exploited by the QHosts Trojan horse, despite minimal community discussion or media coverage.