$ cve CVE-2006-4777 JSON

CVE-2006-4777 EXPLOIT

7.6

HIGH · CVSS 2.0 · EPSS 79.8% (pctl 100)

Patch early

A public exploit exists.

Description

Heap-based buffer overflow in the DirectAnimation Path Control (DirectAnimation.PathControl) COM object (daxctle.ocx) for Internet Explorer 6.0 SP1, on Chinese and possibly other Windows distributions, allows remote attackers to execute arbitrary code via unknown manipulations in arguments to the KeyFrame method, possibly related to an integer overflow, as demonstrated by daxctle2, and a different vulnerability than CVE-2006-4446.

Scoring

CVSS	7.6 (HIGH, v2.0)
Vector	AV:N/AC:H/Au:N/C:C/I:C/A:C
EPSS	79.78% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-119
On CISA KEV	no
Public exploit	yes
Published	2006-09-14
Last modified	2026-06-16

Affected (1)

Vendor	Product
microsoft	ie

Public exploits

Source	Title	Date
exploit-db	Microsoft Internet Explorer - Daxctle.OCX KeyFrame Method Heap Buffer Overflow (MS06-067) (Metasploit)	2010-07-16
exploit-db	Microsoft Internet Explorer - COM Object Remote Heap Overflow	2006-09-13

References

→ the Explorer · watch your stack · NVD