cbcvebase.
CVE-2006-3059
published 2006-06-17

CVE-2006-3059: Unspecified vulnerability in Microsoft Excel 2000 through 2004 allows remote user-assisted attackers to execute arbitrary code via unspecified vectors. NOTE…

PriorityP270critical9.3CVSS 2.0
AVNACMAuNCCICAC
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
41.11%
98.5th percentile
Unspecified vulnerability in Microsoft Excel 2000 through 2004 allows remote user-assisted attackers to execute arbitrary code via unspecified vectors. NOTE: this is a different vulnerability than CVE-2006-3086.

Affected

5 ranges
VendorProductVersion rangeFixed in
microsoftexcel
microsoftexcel
microsoftexcel
microsoftexcel
microsoftexcel_viewer

Detection & IOCsextracted from sources · hover to see the quote

port4444
bytes
\xd9\xee\xd9\x74\x24\xf4\x5b\x31\xc9\xb1\x5e\x81\x73\x17\x4f\x85\x2f\x98
bytes
\x77\xF5\x76\xDE
bytes
\x77\xF9\x2A\x9B
bytes
D0 CF 11 E0 A1 B1 1A E1
  • The shellcode opens a bind shell on TCP port 4444. Monitor for unexpected outbound/inbound connections on port 4444 following Excel process execution.
  • The exploit targets Excel 2000 on Windows XP SP1 and Windows 2000 SP4. The return address used is a pop/pop/ret gadget in NTDLL.DLL at 0x77F576DE (XP SP1 English) or jmp ebx at 0x77F92A9B (Win2K SP4 English). These specific addresses in stack frames during Excel crashes are strong indicators of exploitation.
  • CVE-2006-3059 is a distinct vulnerability from CVE-2006-3086 (HrShellOpenWithMonikerDisplayName buffer overflow in hlink.dll). Do not conflate the two; CVE-2006-3059 relates to malformed URL handling within Excel itself.
  • ·The buff_size (0x152E) and seh_off (4855) values are approximate and variant across different Excel versions; analysts should verify offsets in a debugger for other targets.

CVSS provenance

nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vulncheck9.3CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.