CVE-2006-4868

EXPLOITED

Microsoft Outlook & IE 6.0 - Buffer Overflow

Title source: llm

Description

Stack-based buffer overflow in the Vector Graphics Rendering engine (vgx.dll), as used in Microsoft Outlook and Internet Explorer 6.0 on Windows XP SP2, and possibly other versions, allows remote attackers to execute arbitrary code via a Vector Markup Language (VML) file with a long fill parameter within a rect tag.

Exploits (4)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotewindows
https://www.exploit-db.com/exploits/16597
exploitdb WORKING POC VERIFIED
by Trirat Puttaraksa · perlremotewindows
https://www.exploit-db.com/exploits/2426
exploitdb WORKING POC VERIFIED
by jamikazu · htmlremotewindows
https://www.exploit-db.com/exploits/2425
metasploit WORKING POC NORMAL
by hdm · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms06_055_vml_method.rb

References (21)

... and 1 more

Scores

EPSS 0.6844
EPSS Percentile 98.6%

Details

VulnCheck KEV 2006-09-26
CWE
CWE-119
Status published
Products (3)
microsoft/internet_explorer 6.0
microsoft/internet_explorer 5.0.1 sp4
microsoft/outlook 2003
Published Sep 19, 2006
Tracked Since Feb 18, 2026