CVE-2006-3890

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 14.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-11-21 · updated 2026-06-16

Description

Stack-based buffer overflow in the Sky Software FileView ActiveX control, as used in WinZip 10 before build 7245 and in certain other applications, allows remote attackers to execute arbitrary code via a long FilePattern attribute in a WZFILEVIEW object, a different vulnerability than CVE-2006-5198.

Affected products

Sky Software Fileview Activex Control: all versions
WinZip Computing WinZip: through 10.0; 7.0, 8.0, 8.1, 8.1-sr1, 9.0

References

http://secunia.com/advisories/22891
http://www.kb.cert.org/vuls/id/225217
http://www.securityfocus.com/archive/1/451566/100/0/threaded
http://www.securityfocus.com/bid/21060
http://www.securityfocus.com/bid/21108
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-067
https://www.exploit-db.com/exploits/2785
http://secunia.com/advisories/22891
http://www.kb.cert.org/vuls/id/225217
http://www.securityfocus.com/archive/1/451566/100/0/threaded
http://www.securityfocus.com/bid/21060
http://www.securityfocus.com/bid/21108

Get alerted when CVE-2006-3890 or the next vulnerability affects your stack