CVE-2006-2376: Microsoft Windows 98

High severity, CVSS 7.5. EPSS: 41.1% chance of exploitation in the next 30 days.

Integer overflow in the PolyPolygon function in Graphics Rendering Engine on Microsoft Windows 98 and Me allows remote attackers to execute arbitrary code via a Windows Metafile (WMF) or EMF image with a sum of entries in the vertext counts array and number of polygons that triggers a heap-based buffer overflow.

Affected products

• Microsoft Windows 98: any version
• Microsoft Windows 98se: any version
• Microsoft Windows Me: any version

Published 2006-06-13. Last modified 2026-06-16.