$ cve CVE-2006-0564 JSON

CVE-2006-0564 EXPLOIT

7.5

HIGH · CVSS 2.0 · EPSS 71.7% (pctl 99)

Patch early

A public exploit exists.

Description

Stack-based buffer overflow in Microsoft HTML Help Workshop 4.74.8702.0, and possibly earlier versions, and as included in the Microsoft HTML Help 1.4 SDK, allows context-dependent attackers to execute arbitrary code via a .hhp file with a long Contents file field.

Scoring

CVSS	7.5 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS	71.7% — more likely to be exploited than 99% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2006-02-06
Last modified	2026-06-16

Affected (2)

Vendor	Product
microsoft	html help
microsoft	html help workshop

Public exploits

Source	Title	Date
exploit-db	Microsoft HTML Help Workshop 4.74 - '.hhp' Cotent Buffer Overflow (Metasploit) (2)	2010-09-25
exploit-db	Microsoft HTML Help Workshop 4.74 - '.hhp' compiled Buffer Overflow (Metasploit) (4)	2010-09-25
exploit-db	Microsoft HTML Help Workshop 4.74 - '.hhp' Local Buffer Overflow (1)	2009-12-05
exploit-db	Microsoft HTML Workshop 4.74 - Universal Buffer Overflow	2009-01-12
exploit-db	Microsoft HTML Help Workshop - '.hhp' Local Buffer Overflow (3)	2006-02-14
exploit-db	Microsoft HTML Help Workshop - '.hhp' Local Buffer Overflow (2)	2006-02-11
exploit-db	Microsoft HTML Help Workshop - '.hhp' Denial of Service	2006-02-10
exploit-db	Microsoft HTML Help Workshop - '.hhp' Local Buffer Overflow (1)	2006-02-06

References

→ the Explorer · watch your stack · NVD