Microsoft Internet Explorer versions 5.0 to 6.0 allocate memory for BMP files without verifying the actual size of them, allowing memory resources to be easily maxed, resulting in a denial of service.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/33059/MSIE.BMP.txt
Source: https://packetstormsecurity.com/files/33059/MSIE.BMP.txt.html