CVE-2006-4033: Lhaplus

Medium severity, CVSS 5.1. EPSS: 5% chance of exploitation in the next 30 days.

Heap-based buffer overflow in Lhaplus.exe in Lhaplus 1.52, and possibly earlier versions, allows remote attackers to execute arbitrary code via an LZH archive with a long header, as specified by the extendedHeaderSize.

Affected products

• Lhaplus Lhaplus: version 1.52 only

Published 2006-08-09. Last modified 2026-06-16.