CVE-2006-2492
High 8.8 Exploited in the wild (KEV)
Confirmed active exploitation — CISA KEV catalog
- Name
- Microsoft Word Malformed Object Pointer Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
Buffer overflow in Microsoft Word in Office 2000 SP3, Office XP SP3, Office 2003 Sp1 and SP2, and Microsoft Works Suites through 2006, allows user-assisted attackers to execute arbitrary code via a malformed object pointer, as originally reported by ISC on 20060519 for a zero-day attack.
Metrics
- CVSS 3.1
-
8.8 (HIGH)
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 48% (percentile: 99) as of 1 November 2026
- CWE
- CWE-120
Affected products
microsoft: office; microsoft: works suite
References
- http://secunia.com/advisories/20153 Broken LinkPatchVendor Advisory
- http://www.microsoft.com/technet/security/advisory/919637.mspx Broken LinkPatchVendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-0… PatchVendor Advisory
- http://secunia.com/advisories/20153 Broken LinkPatchVendor Advisory
- http://www.microsoft.com/technet/security/advisory/919637.mspx Broken LinkPatchVendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-0… PatchVendor Advisory
- http://www.securityfocus.com/bid/18037 Broken LinkPatchThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/18037 Broken LinkPatchThird Party AdvisoryVDB Entry
- http://isc.sans.org/diary.php?storyid=1345 Exploit
- http://isc.sans.org/diary.php?storyid=1346 Exploit