What’s Vulnerable › Vulnerabilities

CVE-2006-2492: Microsoft Word Malformed Object Pointer Vulnerability

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2022-06-08
• EPSS: 48.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2006-05-20 · updated 2026-06-16
• Weakness: CWE-120

Description

Buffer overflow in Microsoft Word in Office 2000 SP3, Office XP SP3, Office 2003 Sp1 and SP2, and Microsoft Works Suites through 2006, allows user-assisted attackers to execute arbitrary code via a malformed object pointer, as originally reported by ISC on 20060519 for a zero-day attack.

Affected products

• Microsoft Office: 2000-sp3, 2003-sp1, 2003-sp2, xp-sp3
• Microsoft Works Suite: from 2000 through 2006

References

• http://blogs.technet.com/msrc/archive/2006/05/19/429353.aspx
• http://isc.sans.org/diary.php?storyid=1345
• http://isc.sans.org/diary.php?storyid=1346
• http://secunia.com/advisories/20153
• http://securitytracker.com/id?1016130
• http://www.kb.cert.org/vuls/id/446012
• http://www.microsoft.com/technet/security/advisory/919637.mspx
• http://www.osvdb.org/25635
• http://www.securityfocus.com/bid/18037
• http://www.us-cert.gov/cas/techalerts/TA06-139A.html
• http://www.us-cert.gov/cas/techalerts/TA06-164A.html
• http://www.vupen.com/english/advisories/2006/1872

Get alerted when CVE-2006-2492 or the next vulnerability affects your stack