CVE-2006-4868
HIGH · CVSS 9.3EPSS 61.4%EU EUVD
Stack-based buffer overflow in the Vector Graphics Rendering engine (vgx.dll), as used in Microsoft Outlook and Internet Explorer 6.0 on Windows XP SP2, and possibly other versions, allows remote attackers to execute arbitrary code via a Vector Markup Language (VML) file with a long fill parameter within a rect tag.
Key facts
- CVSS score
- 9.3 (v2.0)
- Severity
- HIGH
- CVSS vector
AV:N/AC:M/Au:N/C:C/I:C/A:C- Weakness (CWE)
- CWE-119
- EPSS score
- 61.4% (99th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2006-4855)
- Published
- September 19, 2006
- NVD last modified
- June 16, 2026
- Status
- Modified
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2006-4855 in the EU Vulnerability Database. Last updated in EUVD on August 7, 2024.
View on the EU Vulnerability DatabaseAffected products
- microsoft / internet explorer
- microsoft / internet explorer
- microsoft / outlook
- microsoft / windows 2000
- microsoft / windows 2003 server
- microsoft / windows 2003 server
- microsoft / windows 2003 server
- microsoft / windows 2003 server
- microsoft / windows 2003 server
- microsoft / windows xp
- microsoft / windows xp
- microsoft / windows xp
References
- http://blogs.securiteam.com/index.php/archives/624
- http://secunia.com/advisories/21989(Patch, Vendor Advisory)
- http://securitytracker.com/id?1016879
- http://sunbeltblog.blogspot.com/2006/09/seen-in-wild-zero-day-exploit-being.html
- http://support.microsoft.com/kb/925486
- http://www.kb.cert.org/vuls/id/416092(US Government Resource)
- http://www.microsoft.com/technet/security/advisory/925568.mspx(Patch, Vendor Advisory)
- http://www.osvdb.org/28946
- http://www.securityfocus.com/archive/1/446378/100/0/threaded
- http://www.securityfocus.com/archive/1/446505/100/0/threaded
- http://www.securityfocus.com/archive/1/446523/100/0/threaded
- http://www.securityfocus.com/archive/1/446528/100/0/threaded
- http://www.securityfocus.com/archive/1/446881/100/200/threaded
- http://www.securityfocus.com/archive/1/447070/100/0/threaded
- http://www.securityfocus.com/archive/1/448552/100/0/threaded
- http://www.securityfocus.com/bid/20096(Exploit, Patch)
- http://www.us-cert.gov/cas/techalerts/TA06-262A.html(Patch, US Government Resource)
- http://www.vupen.com/english/advisories/2006/3679(Vendor Advisory)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-055
- https://exchange.xforce.ibmcloud.com/vulnerabilities/29004
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain