CVE-2006-2376

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Integer overflow in the PolyPolygon function in Graphics Rendering Engine on Microsoft Windows 98 and Me allows remote attackers to execute arbitrary code via a Windows Metafile (WMF) or EMF image with a sum of entries in the vertext counts array and number of polygons that triggers a heap-based buffer overflow.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-189

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/20631Patch, Vendor Advisory
http://securityreason.com/securityalert/1094
http://securitytracker.com/id?1016286
http://www.kb.cert.org/vuls/id/909508US Government Resource
http://www.osvdb.org/26431
http://www.securityfocus.com/archive/1/436950/100/0/threaded
http://www.securityfocus.com/bid/18322
http://www.us-cert.gov/cas/techalerts/TA06-164A.htmlUS Government Resource
http://www.vupen.com/english/advisories/2006/2324Vendor Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-026
https://exchange.xforce.ibmcloud.com/vulnerabilities/26815
http://secunia.com/advisories/20631Patch, Vendor Advisory
http://securityreason.com/securityalert/1094
http://securitytracker.com/id?1016286
http://www.kb.cert.org/vuls/id/909508US Government Resource
http://www.osvdb.org/26431
http://www.securityfocus.com/archive/1/436950/100/0/threaded
http://www.securityfocus.com/bid/18322
http://www.us-cert.gov/cas/techalerts/TA06-164A.htmlUS Government Resource
http://www.vupen.com/english/advisories/2006/2324Vendor Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-026
https://exchange.xforce.ibmcloud.com/vulnerabilities/26815

Timeline

Published: Jun 13, 2006
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2006

CVE-2006-23786.8Buffer overflow in the ART Image Rendering component (jgdw400.dll) in Microsoft Windows XP SP1 and Sp2, Server 2003 SP1 and earlier, and Win CVE-2006-23799.3Buffer overflow in the TCP/IP Protocol driver in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote a CVE-2006-23804.3Microsoft Windows 2000 SP4 does not properly validate an RPC server during mutual authentication over SSL, which allows remote attackers to CVE-2006-238210.0Heap-based buffer overflow in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to execute arbitrary code v CVE-2006-23839.3Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to execute arbitrary code vi CVE-2006-23844.3Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to conduct spoofing and phishing attacks by using a modal CVE-2006-23857.6Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows user-assisted remote attackers to execute arb CVE-2006-23866.8Unspecified vulnerability in Microsoft Outlook Express 6 and earlier allows remote attackers to execute arbitrary code via a crafted contact CVE-2006-23875.1Unspecified vulnerability in Microsoft Excel 2000, 2002, 2003, 2004 for Mac, v.X for Mac, Excel Viewer 2003, and Microsoft Works Suite 2004 CVE-2006-23889.3Microsoft Office Excel 2000 through 2004 allows user-assisted attackers to execute arbitrary code via malformed cell comments, which lead to CVE-2006-23899.3Unspecified vulnerability in Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, and other products, allows user-assisted att CVE-2006-23905.8Cross-site scripting (XSS) vulnerability in OZJournals 1.2 allows remote attackers to inject arbitrary web script or HTML via the vname para