CVE-2006-3638: Microsoft Ie

High severity, CVSS 7.5. EPSS: 36.8% chance of exploitation in the next 30 days.

Microsoft Internet Explorer 5.01 and 6 does not properly handle uninitialized COM objects, which allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code, as demonstrated by the Nth function in the DirectAnimation.DATuple ActiveX control, aka "COM Object Instantiation Memory Corruption Vulnerability."

Affected products

• Microsoft Ie: version 6.0 only
• Microsoft Internet Explorer: version 5.0.1 only; version 6.0 only

Published 2006-08-08. Last modified 2026-06-16.