Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2006-2389 — Code Injection in Microsoft Office

CWE-94 — Code Injection7 documents3 sources
Severity
9.3CRITICALNVD
EPSS
74.2%
top 1.15%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Microsoft Office
Timeline
PublishedJul 11
Latest updateMay 1

Description

Unspecified vulnerability in Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, and other products, allows user-assisted attackers to execute arbitrary code via an Office file with a malformed property that triggers memory corruption related to record lengths, aka "Microsoft Office Property Vulnerability," a different vulnerability than CVE-2006-1316.

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages1 packages

▶NVDmicrosoft/office2000, 2003, xp+2

🔴Vulnerability Details

2
GHSA
GHSA-q6ch-7835-jp5v: Unspecified vulnerability in Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, and other products, allows user-assisted attackers to↗2022-05-01
▶
GHSA
GHSA-mc3v-59x4-8r59: Unspecified vulnerability in Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, and other products, allows user-assisted attackers to↗2022-05-01
▶

💥Exploits & PoCs

3
Exploit-DB
NetBSD 3.1 - 'FTPd / Tnftpd' Port Remote Buffer Overflow↗2006-12-01
▶
Exploit-DB
NetBSD - 'FTPd / Tnftpd' Remote Stack Overflow (PoC)↗2006-11-30
▶
Exploit-DB
Microsoft Office 2000/2002 - Property Code Execution↗2006-07-11
▶
CVE-2006-2389 — Code Injection in Microsoft Office | cvebase