CVE-2006-2492KEV · OVERDUE

Microsoft Word Malformed Object Pointer Vulnerability

High · published May 20, 2006

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 98.9th percentile for exploit probability.

1584
days past CISA
deadline
CVSS v3.1
8.8
EPSS
48%
Percentile
98.9
In the wild
Confirmed
What it is

🚨 A malformed object pointer in Microsoft Word could lead to a devastating buffer overflow, letting attackers run arbitrary code with just a crafty document! 🔥 Think of it like a poorly designed recipe that allows an inexperienced chef to swap in dangerous ingredients without anyone noticing — the result could be a kitchen disaster! If exploited, this vulnerability could grant an attacker full control over the victim's machine, allowing them to install malware, steal sensitive information, or even access corporate networks. The consequences can be absolutely catastrophic for individuals and organizations alike!

Put simply

Think of it like a poorly designed recipe that allows an inexperienced chef to swap in dangerous ingredients without anyone noticing — the result could be a kitchen disaster! This buffer overflow vulnerability affects Microsoft Word and allows attackers to manipulate object pointers to execute arbitrary code, compromising the system when a user opens a malicious document.

What to do

If exploited, this vulnerability could grant an attacker full control over the victim's machine, allowing them to install malware, steal sensitive information, or even access corporate networks. The consequences can be absolutely catastrophic for individuals and organizations alike! To protect against this threat, ensure you have the latest patches installed for Microsoft Office, specifically targeting versions 2000 SP3, XP SP3, and 2003 SP1/SP2. Additionally, advise users against opening unknown or suspicious documents that could exploit this vulnerability. You've got this! By taking these steps, you can safeguard yourself and your systems from potential attacks. 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.48107 · 98.9th percentile
Published
2006-05-20T00:00Z
KEV added
2022-06-08 · due 2022-06-22
EPSS history
Timeline
  • 08 JUN 00:00Z
    Added to CISA KEV — remediate by Jun 22
    kev
  • 20 MAY 00:00Z
    Buffer overflow in Microsoft Word in Office 2000 SP3, Office XP SP3, Office 2003 Sp1 and SP2, and Microsoft Works Suites through 2006, allows user-assisted…
    cvelistv5