CVE-2006-7157

Google Earth 4.0.2091 - Denial of Service via Long href Element in KML/KMZ File

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-7157. PoCs published by JAAScois.

AI-analyzed exploit summary This exploit generates malformed KML files with excessively long buffers to trigger a buffer overflow in Google Earth v4.0.2091(beta). The PoC creates two files: one with NOP sleds (0x90) and another with 'A' characters (0x41) to demonstrate the vulnerability.

Description

Buffer overflow in Google Earth v4.0.2091 (beta) allows remote user-assisted attackers to cause a denial of service (crash) via a KML or KMZ file with a long href element.

Exploits (1)

exploitdb WORKING POC VERIFIED
by JAAScois · cdoswindows
https://www.exploit-db.com/exploits/28785

This exploit generates malformed KML files with excessively long buffers to trigger a buffer overflow in Google Earth v4.0.2091(beta). The PoC creates two files: one with NOP sleds (0x90) and another with 'A' characters (0x41) to demonstrate the vulnerability.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Theoretical
Target: Google Earth v4.0.2091(beta)
No auth needed
Prerequisites: Victim must open the malformed KML file in Google Earth
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (6)

Core 6
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/20464
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/448544/100/0/threaded
Not Applicable third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/2375
Not Applicable mailing-list x_refsource_fulldisc
http://marc.info/?l=full-disclosure&m=116068034629718&w=2
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/29502

Scores

EPSS 0.0730
EPSS Percentile 93.6%

Details

CWE
CWE-119
Status published
Products (1)
google/earth 4.0.2091 beta
Published Mar 07, 2007
Tracked Since Feb 18, 2026