CVE-2006-3649: microsoft visual_basic
Vulnerability summary
CVE-2006-3649 is a medium (CVSS 5.1) vulnerability in microsoft visual_basic. EPSS estimates a 10.17% chance of exploitation in the next 30 days, higher than 95.6% of scored vulnerabilities.
Timeline
- 09-08-2006PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
Buffer overflow in Microsoft Visual Basic for Applications (VBA) SDK 6.0 through 6.4, as used by Microsoft Office 2000 SP3, Office XP SP3, Project 2000 SR1, Project 2002 SP1, Access 2000 Runtime SP3, Visio 2002 SP2, and Works Suite 2004 through 2006, allows user-assisted attackers to execute arbitrary code via unspecified document properties that are not verified when VBA is invoked to open documents.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
10.17%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
0.00 pp
From 10.17% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Microsoft1 product
- visual_basic6.2 | 6.3 | 6.4
1 vendor · 1 product
References
8 links
docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-047Vendor AdvisoryX Refsource MS- www.us-cert.gov/cas/techalerts/TA06-220A.htmlThird Party AdvisoryX Refsource CERTPatchUS Government Resource
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A694VDB EntrySignatureX Refsource OVAL