CVE-2006-4686: Microsoft XML Core Services

High severity, CVSS 7.5. EPSS: 30.3% chance of exploitation in the next 30 days.

Buffer overflow in the Extensible Stylesheet Language Transformations (XSLT) processing in Microsoft XML Parser 2.6 and XML Core Services 3.0 through 6.0 allows remote attackers to execute arbitrary code via a crafted Web page.

Affected products

• Microsoft XML Core Services: version 3.0 only; version 4.0 only; version 6.0 only
• Microsoft XML Parser: version 2.6 only

Published 2006-10-10. Last modified 2026-06-16.