Every CVE Search/ Get API key

CVE-2006-6696

Double free vulnerability in Microsoft Windows 2000, XP, 2003, and Vista allows local users to...

6.9 MediumPublic exploit

Double free vulnerability in Microsoft Windows 2000, XP, 2003, and Vista allows local users to gain privileges by calling the MessageBox function with a MB_SERVICE_NOTIFICATION message with crafted data, which sends a HardError message to Client/Server Runtime Server Subsystem (CSRSS) process, which is not properly handled when invoking the UserHardError and GetHardErrorText functions in WINSRV.DLL.

Exploit likelihood

3.41%Down 9.7 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.9

Double free vulnerability in Microsoft Windows 2000, XP, 2003, and Vista allows local users to gain privileges by calling the MessageBox function with a MB_SERVICE_NOTIFICATION message with crafted data, which sends a HardError message to Client/Server Runtime Server Subsystem (CSRSS) process, which is not properly handled when invoking the UserHardError and GetHardErrorText functions in WINSRV.DLL.

Record
CVE-2006-6696
CVSS 2.0
6.9 MediumAV:L/AC:M/Au:N/C:C/I:C/A:C
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

Double free vulnerability in Microsoft Windows 2000, XP, 2003, and Vista allows local users to gain privileges by calling the MessageBox function with a MB_SERVICE_NOTIFICATION message with crafted data, which sends a HardError message to Client/Server Runtime Server Subsystem (CSRSS) process, which is not properly handled when invoking the UserHardError and GetHardErrorText functions in WINSRV.DLL.

Record
CVE-2006-6696
Updated
2026-11-02
EUVDEUVD-2006-6679 No score

Double free vulnerability in Microsoft Windows 2000, XP, 2003, and Vista allows local users to gain privileges by calling the MessageBox function with a MB_SERVICE_NOTIFICATION message with crafted data, which sends a HardError message to Client/Server Runtime Server Subsystem (CSRSS) process, which is not properly handled when invoking the UserHardError and GetHardErrorText functions in WINSRV.DLL.

Record
EUVD-2006-6679
Updated
2026-11-03
GitHub AdvisoriesGHSA-fmp2-4wcx-jwx4 No score

Double free vulnerability in Microsoft Windows 2000, XP, 2003, and Vista allows local users to...

Double free vulnerability in Microsoft Windows 2000, XP, 2003, and Vista allows local users to gain privileges by calling the MessageBox function with a MB_SERVICE_NOTIFICATION message with crafted data, which sends a HardError message to Client/Server Runtime Server Subsystem (CSRSS) process, which is not properly handled when invoking the UserHardError and GetHardErrorText functions in WINSRV.DLL.

Record
GHSA-fmp2-4wcx-jwx4
Weakness
CWE-119
Updated
2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBMicrosoft Windows - 'MessageBox' Memory Corruption Local Denial of Service2006-12-20
Exploit-DBMicrosoft Windows - NtRaiseHardError 'Csrss.exe' Memory Disclosure2006-12-27

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2006-6696 is a medium vulnerability (CVSS 6.9) in Microsoft Windows 2000, published December 22, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.41%, the 88th percentile. No source names a fixed version.

References

Show 19 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open