CVE-2006-4687

Severity: medium (CVSS 5.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 26.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-11-14 · updated 2026-06-16
Weakness: CWE-119

Description

Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via crafted layout combinations involving DIV tags and HTML CSS float properties that trigger memory corruption, aka "HTML Rendering Memory Corruption Vulnerability."

Affected products

Microsoft Ie: 6-windows_server_2003_sp1
Microsoft Internet Explorer 11: 5.1, 5.5, 5.5-preview, 5.5-sp1, 5.5-sp2

References

http://securitytracker.com/id?1017223
http://www.kb.cert.org/vuls/id/197852
http://www.osvdb.org/31323
http://www.securityfocus.com/archive/1/451590/100/100/threaded
http://www.securityfocus.com/bid/21020
http://www.us-cert.gov/cas/techalerts/TA06-318A.html
http://www.vupen.com/english/advisories/2006/4505
http://www.zerodayinitiative.com/advisories/ZDI-06-041.html
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-067
https://exchange.xforce.ibmcloud.com/vulnerabilities/29199
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A456
http://securitytracker.com/id?1017223

Get alerted when CVE-2006-4687 or the next vulnerability affects your stack