CVE-2006-2492highunder attackCWE-120

CVE-2006-2492

Published · Updated

Follow this CVE+ Monitor Microsoft Word

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 8.8epss 48%
from disclosure to weapon
Published on NVDMay 20
CISA KEV+5863d
Action required by CISAfederal deadline: 2022-06-22

Apply updates per vendor instructions.

In short

Microsoft Word has a buffer overflow vulnerability that allows attackers to run malicious code if a user opens a specially crafted document. This happens when Word incorrectly handles a malformed object pointer, potentially compromising the user's computer.

Technical detail

Buffer overflow in Microsoft Word's object pointer handling (CWE-120) affects multiple Office versions (2000 SP3, XP SP3, 2003 SP1/SP2) and Works Suites through 2006. Exploitation requires user interaction to open a malformed document; successful exploitation leads to arbitrary code execution with user privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Buffer overflow in Microsoft Word in Office 2000 SP3, Office XP SP3, Office 2003 Sp1 and SP2, and Microsoft Works Suites through 2006, allows user-assisted attackers to execute arbitrary code via a malformed object pointer, as originally reported by ISC on 20060519 for a zero-day attack.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
n/a · n/a