CVE-2006-1016 EXPLOIT
7.5
HIGH · CVSS 2.0 · EPSS 67% (pctl 99)
Patch early
A public exploit exists.
Description
Buffer overflow in the IsComponentInstalled method in Internet Explorer 6.0, when used on Windows 2000 before SP4 or Windows XP before SP1, allows remote attackers to execute arbitrary code via JavaScript that calls IsComponentInstalled with a long first argument.
Scoring
| CVSS | 7.5 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| EPSS | 66.95% — more likely to be exploited than 99% of all CVEs |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2006-03-07 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| microsoft | internet explorer |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Microsoft Internet Explorer - isComponentInstalled Overflow (Metasploit) | 2010-05-09 |
References
- http://metasploit.com/projects/Framework/exploits.html#ie_iscomponentinstalled
- http://www.metasploit.com/projects/Framework/modules/exploits/ie_iscomponentinstalled.pm
- http://www.securityfocus.com/bid/16870
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24923
- http://metasploit.com/projects/Framework/exploits.html#ie_iscomponentinstalled
- http://www.metasploit.com/projects/Framework/modules/exploits/ie_iscomponentinstalled.pm
- http://www.securityfocus.com/bid/16870
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24923
→ the Explorer · watch your stack · NVD