cbcvebase.
CVE-2006-6561
published 2006-12-14

CVE-2006-6561: Unspecified vulnerability in Microsoft Word 2000, 2002, and Word Viewer 2003 allows user-assisted remote attackers to execute arbitrary code via a crafted DOC…

PriorityP269critical9.3CVSS 2.0
AVNACMAuNCCICAC
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
40.43%
98.5th percentile
Unspecified vulnerability in Microsoft Word 2000, 2002, and Word Viewer 2003 allows user-assisted remote attackers to execute arbitrary code via a crafted DOC file that triggers memory corruption, as demonstrated via the 12122006-djtest.doc file, a different issue than CVE-2006-5994 and CVE-2006-6456.

Affected

12 ranges
VendorProductVersion rangeFixed in
microsoftoffice
microsoftoffice
microsoftoffice
microsoftoffice
microsoftword
microsoftword
microsoftword
microsoftword_viewer
microsoftworks
microsoftworks
microsoftworks
openofficeopenoffice

Detection & IOCsextracted from sources · hover to see the quote

urlhttps://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/2922.doc
filename12122006-djtest.doc
bytes
offset 0x000027e4 == 41414141
bytes
offset 0x00000274 == 00000022
  • The exploit is a two-stage malformed DOC: stage 1 forces execution down a wrong code path; stage 2 (harmless alone) triggers a pointer overwrite when combined. Detection should look for the specific weight/marker field combination rather than either field in isolation.
  • The write primitive follows the formula: destination = ((weight * 4[EDI]) + 4[ECX*4]) + source_memory_offset[ESI]. Monitor for abnormal memory writes in Word/WordViewer processes matching this arithmetic pattern.
  • ·Red Hat assessed this CVE (tracked as CVE-2006-6628 in the OOo codebase) as crash-only with no possibility of arbitrary code execution, so detection priority may be lower in OpenOffice.org deployments.
  • ·CVE-2006-6561 affects Microsoft Word/WordViewer, while the closely related CVE-2006-6628 affects OpenOffice.org 2.1 — the same PoC file (12122006-djtest.doc) demonstrates both, but they are separate codebases and separate CVEs.

CVSS provenance

nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vulncheck9.3CRITICAL
vendor_redhat9.3CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.