CVE-2006-1985: Apple Mac OS X

Medium severity, CVSS 5.1. EPSS: 13.9% chance of exploitation in the next 30 days.

Heap-based buffer overflow in BOM BOMArchiveHelper 10.4 (6.3) Build 312, as used in Mac OS X 10.4.6 and earlier, allows user-assisted attackers to execute arbitrary code via a crafted archive (such as ZIP) that contains long path names, which triggers an error in the BOMStackPop function.

Affected products

• Apple Mac OS X: version 10.3 only; version 10.3.1 only; version 10.3.2 only; version 10.3.3 only; version 10.3.4 only; version 10.3.5 only; …
• Apple Mac OS X Server: version 10.3 only; version 10.3.1 only; version 10.3.2 only; version 10.3.3 only; version 10.3.4 only; version 10.3.5 only; …
• Apple Safari: version 2.0 only; version 2.0.1 only; version 2.0.2 only; version 2.0.3 only

Published 2006-04-21. Last modified 2026-06-16.