cbcvebase.
CVE-2006-3656
published 2006-07-18

CVE-2006-3656: Unspecified vulnerability in Microsoft PowerPoint 2003 allows user-assisted attackers to cause memory corruption via a crafted PowerPoint file, which triggers…

PriorityP421low2.6CVSS 2.0
AVNACHAuNCNIPAN
EXPLOIT
EPSS
20.52%
97.5th percentile
Unspecified vulnerability in Microsoft PowerPoint 2003 allows user-assisted attackers to cause memory corruption via a crafted PowerPoint file, which triggers the corruption when the file is closed. NOTE: due to the lack of available details as of 20060717, it is unclear how this is related to CVE-2006-3655, CVE-2006-3660, and CVE-2006-3590, although it is possible that they are all different.

Affected

1 ranges
VendorProductVersion rangeFixed in
microsoftpowerpoint——

Detection & IOCsextracted from sources · hover to see the quote

filenamemme.ppt↗
bytes↗
50 4B 03 04 14 00 00 00 08 00 9A A9 EB 34 2C E4 59 27 E3 2D 00 00 00 8C 00 00 07 00 00 00 6D 6D 65 2E 70 70 74
  • →Memory corruption is triggered specifically when the crafted .ppt file is closed in PowerPoint 2003, not on open — monitor for crashes/access violations in POWERPNT.EXE during file-close operations on .ppt files. ↗
  • →The PoC file is named 'mme.ppt' (bytes 0x6D 0x6D 0x65 0x2E 0x70 0x70 0x74 embedded in the payload); hunt for this filename in endpoint telemetry. ↗
  • →The malicious .ppt file begins with the PK ZIP magic bytes (50 4B 03 04), indicating it uses a ZIP-based container format; inspect .ppt files with this header for anomalies. ↗
  • ·The vulnerability is unspecified and its exact relationship to CVE-2006-3655, CVE-2006-3660, and CVE-2006-3590 is unclear; the same PoC file may overlap with those CVEs. ↗
  • ·It is unconfirmed whether the vulnerability allows arbitrary code execution or only a crash/denial-of-service. ↗
  • ·Only Microsoft PowerPoint 2003 was confirmed tested; other versions may also be affected. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.