CVE-2006-6603: Yahoo Messenger

High severity, CVSS 9.3. EPSS: 6.6% chance of exploitation in the next 30 days.

Buffer overflow in the YMMAPI.YMailAttach ActiveX control (ymmapi.dll) before 2005.1.1.4 in Yahoo! Messenger allows remote attackers to execute arbitrary code via a crafted HTML document. NOTE: some details were obtained from third party information.

Affected products

• Yahoo Messenger: up to and including 8.0; version 5.0 only; version 5.5 only; version 5.6 only; version 6.0 only; version 7.0 only; …

Published 2006-12-15. Last modified 2026-06-16.