cbcvebase.
CVE-2006-3655
published 2006-07-18

CVE-2006-3655: Unspecified vulnerability in mso.dll in Microsoft PowerPoint 2003 allows user-assisted attackers to execute arbitrary code via a crafted PowerPoint file. NOTE…

PriorityP335medium5.1CVSS 2.0
AVNACHAuNCPIPAP
EXPLOIT
EPSS
20.89%
97.3th percentile
Unspecified vulnerability in mso.dll in Microsoft PowerPoint 2003 allows user-assisted attackers to execute arbitrary code via a crafted PowerPoint file. NOTE: due to the lack of available details as of 20060717, it is unclear how this is related to CVE-2006-3656, CVE-2006-3660, and CVE-2006-3590, although it is possible that they are all different.

Affected

1 ranges
VendorProductVersion rangeFixed in
microsoftpowerpoint——

Detection & IOCsextracted from sources · hover to see the quote

filenamems0.pp↗
bytes↗
50 4B 03 04 14 00 00 00 08 00 A0 A9 EB 34 CF 73 8B FD D3 2D 00 00 00 8C 00 00 07 00 00 00 6D 73 30 2E 70 70 74
  • →Exploit targets Microsoft PowerPoint 2003 via a crafted .PPT file that triggers memory corruption in mso.dll when the file is processed. ↗
  • →The malicious PPT file is delivered as a ZIP-wrapped archive (PK magic bytes 50 4B 03 04) containing an embedded file named 'ms0.ppt'; inspect ZIP-structured .PPT files with this internal filename. ↗
  • →Memory corruption is triggered in mso.dll during processing of the crafted PowerPoint file; monitor for crashes or abnormal termination of POWERPNT.EXE involving mso.dll. ↗
  • ·It is unclear whether the three proof-of-concept exploit files pertain to newly discovered vulnerabilities or previously disclosed issues; CVE-2006-3655 may overlap with CVE-2006-3656, CVE-2006-3660, and CVE-2006-3590. ↗
  • ·The NVD entry cross-references CVE-2006-3656 and notes ambiguity in the relationship between CVE-2006-3655, CVE-2006-3660, and CVE-2006-3590; treat detections as potentially covering multiple CVEs. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.