peter bassill · operator
$ cve CVE-2006-1992 JSON

CVE-2006-1992 EXPLOIT

2.6
LOW · CVSS 2.0 · EPSS 40.4% (pctl 99)

Patch early

A public exploit exists.

Description

mshtml.dll 6.00.2900.2873, as used in Microsoft Internet Explorer, allows remote attackers to cause a denial of service (crash) via nested OBJECT tags, which trigger invalid pointer dereferences including NULL dereferences. NOTE: the possibility of code execution was originally theorized, but Microsoft has stated that this issue is non-exploitable.

Scoring

CVSS2.6 (LOW, v2.0)
VectorAV:N/AC:H/Au:N/C:N/I:N/A:P
EPSS40.43% — more likely to be exploited than 99% of all CVEs
WeaknessCWE-399
On CISA KEVno
Public exploityes
Published2006-04-25
Last modified2026-06-16

Affected (1)

VendorProduct
microsoftinternet explorer

Public exploits

SourceTitleDate
exploit-dbMicrosoft Internet Explorer 6 - Nested OBJECT Tag Memory Corruption2006-04-22

References

→ the Explorer  ·  watch your stack  ·  NVD