CVE-2006-3431

published 2006-07-07

CVE-2006-3431: Buffer overflow in certain Asian language versions of Microsoft Excel might allow user-assisted attackers to execute arbitrary code via a crafted STYLE record…

Priority P3 46 high 7.5 CVSS 2.0

AV N AC L Au N C P I P A P

EXPLOIT

Buffer overflow in certain Asian language versions of Microsoft Excel might allow user-assisted attackers to execute arbitrary code via a crafted STYLE record in a spreadsheet that triggers the overflow when the user attempts to repair the document or selects the "Style" option, as demonstrated by nanika.xls. NOTE: Microsoft has confirmed to CVE via e-mail that this is different than the other Excel vulnerabilities announced before 20060707, including CVE-2006-3059 and CVE-2006-3086.

Detection & IOCs extracted from sources · hover to see the quote

filename nanika.xls↗

url https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/28189.xls↗

other Trojan.Hongmosa↗

• → Trigger vector is a crafted STYLE record inside an XLS spreadsheet; monitor for Excel opening files containing malformed STYLE records, especially on Asian-language Windows installations. ↗
• → Attack can be delivered via embedded Excel objects inside Word documents — treat Word files as a secondary attack vector for this CVE. ↗
• → Exploitation targets Simplified Chinese, Traditional Chinese, Japanese, and Korean Windows locales; scope detection to those locale/language configurations. ↗

• · This vulnerability is confirmed distinct from CVE-2006-3059 and CVE-2006-3086, despite initial confusion around the nanika.xls PoC being attributed to BID 18422. ↗
• · Only certain Asian language versions of Microsoft Excel are affected; non-Asian locale installations are not vulnerable. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.