CVE-2006-2492: Microsoft Word Malformed Object Pointer Vulnerability

High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-06-08. EPSS: 48.1% chance of exploitation in the next 30 days.

Buffer overflow in Microsoft Word in Office 2000 SP3, Office XP SP3, Office 2003 Sp1 and SP2, and Microsoft Works Suites through 2006, allows user-assisted attackers to execute arbitrary code via a malformed object pointer, as originally reported by ISC on 20060519 for a zero-day attack.

Affected products

• Microsoft Office: version 2000 only; version 2003 only; version xp only
• Microsoft Works Suite: from 2000, up to and including 2006

Published 2006-05-20. Last modified 2026-06-16.