ZeroDay Findings
Sign inSign up

Findings

CVE-2006-2492

Microsoft Word Malformed Object Pointer Vulnerability

Published May 19, 2006 · updated Jun 16, 2026 · microsoft office

Buffer overflow in Microsoft Word in Office 2000 SP3, Office XP SP3, Office 2003 Sp1 and SP2, and Microsoft Works Suites through 2006, allows user-assisted attackers to execute arbitrary code via a malformed object pointer, as originally reported by ISC on 20060519 for a zero-day attack.

Timeline

Detection, updates, and resolution for this record.

  1. May 19, 2006 · Catalog

    Detected

    Buffer overflow in Microsoft Word in Office 2000 SP3, Office XP SP3, Office 2003 Sp1 and SP2, and Microsoft Works Suites through 2006, allows user-assisted attackers to execute arbitrary code via a malformed object pointer, as originally reported by ISC on 20060519 for a zero-day attack.

  2. Jun 8, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Jun 22, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    Buffer overflow in Microsoft Word in Office 2000 SP3, Office XP SP3, Office 2003 Sp1 and SP2, and Microsoft Works Suites through 2006, allows user-assisted attackers to execute arbitrary code via a malformed object pointer, as originally reported by ISC on 20060519 for a zero-day attack.

Required action

Apply updates per vendor instructions.

CISA due date Jun 22, 2022

Affected

  • cpe microsoft/office2000
  • cpe microsoft/office2003
  • cpe microsoft/officexp
  • cpe microsoft/works suiteversion unspecified
  • vendor Microsoft Wordversion unspecified

Sources

  • CISA KEVCVE-2006-2492

    Microsoft Word and Microsoft Works Suites contain a malformed object pointer which allows attackers to execute code.

    cisa.gov
  • CVE.orgCVE-2006-2492

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2006-2492

    30-day exploitation probability 48.1%

    first.org
  • NIST NVDCVE-2006-2492

    Buffer overflow in Microsoft Word in Office 2000 SP3, Office XP SP3, Office 2003 Sp1 and SP2, and Microsoft Works Suites through 2006, allows user-assisted attackers to execute arbitrary code via a malformed object pointer, as originally reported by ISC on 20060519 for a zero-day

    nvd.nist.gov

References