CVE-2006-4686

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 30.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-10-10 · updated 2026-06-16

Description

Buffer overflow in the Extensible Stylesheet Language Transformations (XSLT) processing in Microsoft XML Parser 2.6 and XML Core Services 3.0 through 6.0 allows remote attackers to execute arbitrary code via a crafted Web page.

Affected products

Microsoft Corporation XML Core Services: 3.0, 4.0, 6.0
Microsoft Xml Parser: 2.6

References

http://secunia.com/advisories/22333
http://securitytracker.com/id?1017033
http://www.kb.cert.org/vuls/id/562788
http://www.osvdb.org/29426
http://www.securityfocus.com/archive/1/449179/100/0/threaded
http://www.securityfocus.com/bid/20338
http://www.vupen.com/english/advisories/2006/3980
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-061
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A285
http://secunia.com/advisories/22333
http://securitytracker.com/id?1017033
http://www.kb.cert.org/vuls/id/562788

Get alerted when CVE-2006-4686 or the next vulnerability affects your stack