HIGH
Heap-based buffer overflow in URLMON.DLL in Microsoft Internet Explorer 6 SP1 on Windows 2000 and XP SP1, with versions the MS06-042 patch before 20060824, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a long URL on a website that uses HTTP 1.1 compression
Published Aug 23, 2006
7.5
HIGHCVSS 2.0
EPSS 43.06%
Description
Heap-based buffer overflow in URLMON.DLL in Microsoft Internet Explorer 6 SP1 on Windows 2000 and XP SP1, with versions the MS06-042 patch before 20060824, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a long URL on a website that uses HTTP 1.1 compression.
Affected products
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
No CVSS v3.1 score for this CVE.
No CVSS v3.0 score for this CVE.
7.5 HIGH NVD
AV:N/AC:L/Au:N/C:P/I:P/A:P
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact Partial
Integrity Impact Partial
Availability Impact Partial
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
43.06% 0.43059
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
EPSS probability 0.43059
Score over time
2022–2026- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (19 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 43.06% (0.43059) | 98.68th | v5 (v2026.06.15) |
| Jul 21, 2026 | 43.06% (0.43059) | 98.58th | v5 (v2026.06.15) |
| Jun 15, 2026 | 40.82% (0.40821) | 98.47th | v5 (v2026.06.15) |
| May 21, 2026 | 66.10% (0.66100) | 98.53th | v4 (v2025.03.14) |
| Mar 30, 2025 | 72.09% (0.72094) | 98.66th | v4 (v2025.03.14) |
| Mar 29, 2025 | 69.12% (0.69117) | 98.13th | v4 (v2025.03.14) |
| Mar 17, 2025 | 72.09% (0.72094) | 98.66th | v4 (v2025.03.14) |
| Dec 17, 2024 | 75.82% (0.75817) | 98.38th | v3 (v2023.03.01) |
| Dec 12, 2024 | 94.13% (0.94134) | 99.28th | v3 (v2023.03.01) |
| Jul 13, 2024 | 95.27% (0.95272) | 99.37th | v3 (v2023.03.01) |
| Nov 26, 2023 | 95.41% (0.95413) | 99.18th | v3 (v2023.03.01) |
| Oct 18, 2023 | 95.03% (0.95029) | 99.06th | v3 (v2023.03.01) |
| Aug 3, 2023 | 95.43% (0.95431) | 99.08th | v3 (v2023.03.01) |
| Jun 26, 2023 | 95.32% (0.95317) | 99.02th | v3 (v2023.03.01) |
| May 19, 2023 | 94.77% (0.94771) | 98.83th | v3 (v2023.03.01) |
| Apr 11, 2023 | 94.63% (0.94631) | 98.76th | v3 (v2023.03.01) |
| Mar 7, 2023 | 95.32% (0.95323) | 98.88th | v3 (v2023.03.01) |
| Mar 6, 2023 | 29.37% (0.29369) | 97.29th | v2 (v2022.01.01) |
| Feb 4, 2022 | 29.37% (0.29369) | 96.11th | v2 (v2022.01.01) |
Weaknesses (0)
No CWE recorded.
References (15)
- http://secunia.com/advisories/21557 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://securityreason.com/securityalert/1441 third-party-advisoryx_refsource_SREASON
- http://securitytracker.com/id?1016731 vdb-entryx_refsource_SECTRACK
- http://support.microsoft.com/kb/923762/ x_refsource_CONFIRMPatch
- http://www.kb.cert.org/vuls/id/821156 third-party-advisoryx_refsource_CERT-VNPatchUS Government Resource
- http://www.microsoft.com/technet/security/advisory/923762.mspx x_refsource_CONFIRMPatch
- http://www.nsfocus.com/english/homepage/research/0608.htm x_refsource_MISC
- http://www.osvdb.org/28132 vdb-entryx_refsource_OSVDB
- http://www.securityfocus.com/archive/1/444046/100/0/threaded mailing-listx_refsource_BUGTRAQ
- http://www.securityfocus.com/archive/1/444241/100/0/threaded mailing-listx_refsource_BUGTRAQ
- http://www.securityfocus.com/archive/1/444319/100/0/threaded mailing-listx_refsource_BUGTRAQ
- http://www.securityfocus.com/bid/19667 vdb-entryx_refsource_BID
- http://www.vupen.com/english/advisories/2006/3356 vdb-entryx_refsource_VUPEN
- https://exchange.xforce.ibmcloud.com/vulnerabilities/28522 vdb-entryx_refsource_XF
- https://exchange.xforce.ibmcloud.com/vulnerabilities/28893 vdb-entryx_refsource_XF
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner microsoft
Published Aug 23, 2006
Updated Aug 7, 2024
Reserved Jul 26, 2006
Link CVE-2006-3869
CISA Vulnrichment
Updated n/a