$ cve CVE-2006-6696 JSON

CVE-2006-6696 EXPLOIT

6.9

MEDIUM · CVSS 2.0 · EPSS 3.4% (pctl 89)

Patch early

A public exploit exists.

Description

Double free vulnerability in Microsoft Windows 2000, XP, 2003, and Vista allows local users to gain privileges by calling the MessageBox function with a MB_SERVICE_NOTIFICATION message with crafted data, which sends a HardError message to Client/Server Runtime Server Subsystem (CSRSS) process, which is not properly handled when invoking the UserHardError and GetHardErrorText functions in WINSRV.DLL.

Scoring

CVSS	6.9 (MEDIUM, v2.0)
Vector	AV:L/AC:M/Au:N/C:C/I:C/A:C
EPSS	3.41% — more likely to be exploited than 89% of all CVEs
Weakness	CWE-119
On CISA KEV	no
Public exploit	yes
Published	2006-12-22
Last modified	2026-06-16

Affected (4)

Vendor	Product
microsoft	windows 2000
microsoft	windows 2003 server
microsoft	windows vista
microsoft	windows xp

Public exploits

Source	Title	Date
exploit-db	Microsoft Windows - NtRaiseHardError 'Csrss.exe' Memory Disclosure	2006-12-27
exploit-db	Microsoft Windows - 'MessageBox' Memory Corruption Local Denial of Service	2006-12-20

References

→ the Explorer · watch your stack · NVD