CVE-2006-2492

Published: May 20, 2006Modified: Apr 16, 2026CISA KEV

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Buffer overflow in Microsoft Word in Office 2000 SP3, Office XP SP3, Office 2003 Sp1 and SP2, and Microsoft Works Suites through 2006, allows user-assisted attackers to execute arbitrary code via a malformed object pointer, as originally reported by ISC on 20060519 for a zero-day attack.

Affected (5)

Products: Microsoft: Office, Works Suite

Microsoft

2 products

Office

Works Suite

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Microsoft Office	Version 2000 sp3
Microsoft Office	Version 2003 sp1
Microsoft Office	Version 2003 sp2
Microsoft Office	Version xp sp3
Microsoft Works Suite	From 2000 to 2006

Related CWEs

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

References (35)

http://blogs.technet.com/msrc/archive/2006/05/19/429353.aspx

Source: cret@cert.org

Broken Link

http://isc.sans.org/diary.php?storyid=1345

Source: cret@cert.org

Exploit

http://isc.sans.org/diary.php?storyid=1346

Source: cret@cert.org

Exploit

http://secunia.com/advisories/20153

Source: cret@cert.org

Broken LinkPatchVendor Advisory

http://securitytracker.com/id?1016130

Source: cret@cert.org

Broken LinkThird Party AdvisoryVDB Entry

http://www.kb.cert.org/vuls/id/446012

Source: cret@cert.org

Third Party AdvisoryUS Government Resource

http://www.microsoft.com/technet/security/advisory/919637.mspx

Source: cret@cert.org

Broken LinkPatchVendor Advisory

http://www.osvdb.org/25635

Source: cret@cert.org

Broken Link

http://www.securityfocus.com/bid/18037

Source: cret@cert.org

Broken LinkPatchThird Party AdvisoryVDB Entry

http://www.us-cert.gov/cas/techalerts/TA06-139A.html

Source: cret@cert.org

Broken LinkThird Party AdvisoryUS Government Resource

http://www.us-cert.gov/cas/techalerts/TA06-164A.html

Source: cret@cert.org

Broken LinkThird Party AdvisoryUS Government Resource

http://www.vupen.com/english/advisories/2006/1872

Source: cret@cert.org

Broken Link

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-027

Source: cret@cert.org

PatchVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/26556

Source: cret@cert.org

Third Party AdvisoryVDB Entry

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1418

Source: cret@cert.org

Broken Link

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1738

Source: cret@cert.org

Broken Link

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2068

Source: cret@cert.org

Broken Link

http://blogs.technet.com/msrc/archive/2006/05/19/429353.aspx