CVE-2006-3638

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 36.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-08-08 · updated 2026-06-16
Weakness: CWE-119

Description

Microsoft Internet Explorer 5.01 and 6 does not properly handle uninitialized COM objects, which allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code, as demonstrated by the Nth function in the DirectAnimation.DATuple ActiveX control, aka "COM Object Instantiation Memory Corruption Vulnerability."

Affected products

Microsoft Ie: 6.0-sp1, 6.0-sp2
Microsoft Internet Explorer 11: 5.0.1, 5.0.1-sp1, 5.0.1-sp2, 5.0.1-sp3, 5.0.1-sp4, 6.0

References

http://secunia.com/advisories/21396
http://securitytracker.com/id?1016663
http://www.kb.cert.org/vuls/id/959049
http://www.osvdb.org/27852
http://www.securityfocus.com/archive/1/442728/100/0/threaded
http://www.securityfocus.com/bid/19340
http://www.tippingpoint.com/security/advisories/TSRT-06-09.html
http://www.us-cert.gov/cas/techalerts/TA06-220A.html
http://www.vupen.com/english/advisories/2006/3212
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-042
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A719
http://secunia.com/advisories/21396

Get alerted when CVE-2006-3638 or the next vulnerability affects your stack