A MIME part can have a Content-ID value. HTML content can reference that part using a cid: URI.
This is commonly used for inline images packaged inside the message.
Clients vary in how they render and expose these parts. Security scanners should still inspect them as message content rather than assuming an inline image is safe.