cyfenced.com →

[ CVE-2006-2492 · Published 20 May 2006 ]

Microsoft Word Malformed Object Pointer Vulnerability

Exploited · CISA KEV CVSS 8.8 EPSS 48%Fix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-06-08
  • EPSS: 48% chance of exploitation in the next 30 days (higher than 99% of CVEs)

[ Description ]Official description

Buffer overflow in Microsoft Word in Office 2000 SP3, Office XP SP3, Office 2003 Sp1 and SP2, and Microsoft Works Suites through 2006, allows user-assisted attackers to execute arbitrary code via a malformed object pointer, as originally reported by ISC on 20060519 for a zero-day attack.

CISA: Microsoft Word and Microsoft Works Suites contain a malformed object pointer which allows attackers to execute code.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 22 Jun 2022): Apply updates per vendor instructions.

[ References ]References