$ cve CVE-2006-0006 JSON

CVE-2006-0006 EXPLOIT

9.3

HIGH · CVSS 2.0 · EPSS 49.6% (pctl 99)

Patch early

A public exploit exists.

Description

Heap-based buffer overflow in the bitmap processing routine in Microsoft Windows Media Player 7.1 on Windows 2000 SP4, Media Player 9 on Windows 2000 SP4 and XP SP1, and Media Player 10 on XP SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted bitmap (.BMP) file that specifies a size of 0 but contains additional data.

Scoring

CVSS	9.3 (HIGH, v2.0)
Vector	AV:N/AC:M/Au:N/C:C/I:C/A:C
EPSS	49.56% — more likely to be exploited than 99% of all CVEs
Weakness	CWE-119
On CISA KEV	no
Public exploit	yes
Published	2006-02-14
Last modified	2026-06-16

Affected (7)

Vendor	Product
microsoft	windows 2000
microsoft	windows 2003 server
microsoft	windows 98
microsoft	windows 98se
microsoft	windows me
microsoft	windows media player
microsoft	windows xp

Public exploits

Source	Title	Date
exploit-db	Microsoft Windows Media Player 7.1 < 10 - '.BMP' Heap Overflow (MS06-005) (2)	2006-02-16
exploit-db	Microsoft Windows Media Player 7.1 < 10 - '.BMP' Heap Overflow (PoC) (MS06-005) (1)	2006-02-15

References

→ the Explorer · watch your stack · NVD