CVE-2006-1190

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 61.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-04-11 · updated 2026-06-16

Description

Microsoft Internet Explorer 5.01 through 6 does not always return the correct IOleClientSite information when dynamically creating an embedded object, which could cause Internet Explorer to run the object in the wrong security context or zone, and allow remote attackers to execute arbitrary code.

Affected products

Microsoft Internet Explorer 11: 5.01, 5.1, 5.5, 6.0

References

http://secunia.com/advisories/18957
http://securitytracker.com/id?1015900
http://www.kb.cert.org/vuls/id/959649
http://www.securityfocus.com/bid/17455
http://www.vupen.com/english/advisories/2006/1318
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-013
https://exchange.xforce.ibmcloud.com/vulnerabilities/25552
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1541
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1735
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1783
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A965
http://secunia.com/advisories/18957

Get alerted when CVE-2006-1190 or the next vulnerability affects your stack