CVE-2006-3357

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 35.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-07-06 · updated 2026-06-16

Description

Heap-based buffer overflow in HTML Help ActiveX control (hhctrl.ocx) in Microsoft Internet Explorer 6.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code by repeatedly setting the Image field of an Internet.HHCtrl.1 object to certain values, possibly related to improper escaping and long strings.

Affected products

Microsoft Internet Explorer 11: 6.0

References

http://browserfun.blogspot.com/2006/07/mobb-2-internethhctrl-image-property.html
http://secunia.com/advisories/20906
http://securitytracker.com/id?1016434
http://www.kb.cert.org/vuls/id/159220
http://www.osvdb.org/26835
http://www.securityfocus.com/archive/1/442733/100/0/threaded
http://www.securityfocus.com/bid/18769
http://www.tippingpoint.com/security/advisories/TSRT-06-08.html
http://www.us-cert.gov/cas/techalerts/TA06-220A.html
http://www.vupen.com/english/advisories/2006/2634
http://www.vupen.com/english/advisories/2006/2635
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-046

Get alerted when CVE-2006-3357 or the next vulnerability affects your stack