Live › vulnerability › CVE-2006-2492
Go to dashboardMicrosoft Word and Works Suites mishandle a malformed object pointer in a crafted document. An attacker who gets a user to open a booby-trapped file can run code on that machine.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Microsoft Word | vendor | – | – |
| microsoft office | vendor | = 2000 | – |
| microsoft office | vendor | = 2003 | – |
| microsoft office | vendor | = xp | – |
| microsoft works suite | vendor | >= 2000, <= 2006 | – |
Check whether Microsoft Word or Works Suite is installed and whether it is patched against the update for CVE-2006-2492 (unknown which KB the sources name).
Apply the Microsoft update for CVE-2006-2492 as CISA requires; the sources do not give the bulletin or version number.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Buffer overflow in Microsoft Word in Office 2000 SP3, Office XP SP3, Office 2003 Sp1 and SP2, and Microsoft Works Suites through 2006, allows user-assisted attackers to execute arbitrary code via a malformed object pointer, as originally reported by ISC on 20060519 for a zero-day attack.
This page as .md · .json · in your agent: get_signal("CVE-2006-2492")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.