CVE-2006-3250: Microsoft Windows Live Messenger

Medium severity, CVSS 5.1. EPSS: 6.8% chance of exploitation in the next 30 days.

Heap-based buffer overflow in Windows Live Messenger 8.0 allows user-assisted attackers to execute arbitrary code via a crafted Contact List (.ctt) file, which triggers the overflow when it is imported by the user.

Affected products

• Microsoft Windows Live Messenger: version 8.0 only

Published 2006-06-27. Last modified 2026-06-16.