Log in Start free

Actively exploited · Published May 20, 2006 · Assigned by certcc

CVE-2006-2492

High 8.8 Exploited

In plain English

A high-severity buffer overflow in Word from Microsoft. Attackers are actively exploiting it in the wild (listed by CISA on June 8, 2022). The chance it is exploited in the next 30 days is estimated at 48.1% (higher than 99% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)48.1%top 1.1% of all CVEs
Exploited in the wildYesCISA KEV since Jun 8, 2022
Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Jun 22, 2022.

Official description

Buffer overflow in Microsoft Word in Office 2000 SP3, Office XP SP3, Office 2003 Sp1 and SP2, and Microsoft Works Suites through 2006, allows user-assisted attackers to execute arbitrary code via a malformed object pointer, as originally reported by ISC on 20060519 for a zero-day attack.

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-120 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References