CVE-2006-2058
Argument injection vulnerability in Avant Browser 10.1 Build 17 allows user-assisted remote...
Argument injection vulnerability in Avant Browser 10.1 Build 17 allows user-assisted remote attackers to modify command line arguments to an invoked mail client via " (double quote) characters in a mailto: scheme handler, as demonstrated by launching Microsoft Outlook with an arbitrary filename as an attachment. NOTE: it is not clear whether this issue is implementation-specific or a problem in the Microsoft API.
Exploit likelihood
What each source reports
NVD Score used
Argument injection vulnerability in Avant Browser 10.1 Build 17 allows user-assisted remote attackers to modify command line arguments to an invoked mail client via " (double quote) characters in a mailto: scheme handler, as demonstrated by launching Microsoft Outlook with an arbitrary filename as an attachment. NOTE: it is not clear whether this issue is implementation-specific or a problem in the Microsoft API.
- Record
CVE-2006-2058- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-88
- Updated
- 2026-11-02
CVE List No score
Argument injection vulnerability in Avant Browser 10.1 Build 17 allows user-assisted remote attackers to modify command line arguments to an invoked mail client via " (double quote) characters in a mailto: scheme handler, as demonstrated by launching Microsoft Outlook with an arbitrary filename as an attachment. NOTE: it is not clear whether this issue is implementation-specific or a problem in the Microsoft API.
- Record
CVE-2006-2058- Updated
- 2026-11-02
EUVDEUVD-2006-2059 No score
Argument injection vulnerability in Avant Browser 10.1 Build 17 allows user-assisted remote attackers to modify command line arguments to an invoked mail client via " (double quote) characters in a mailto: scheme handler, as demonstrated by launching Microsoft Outlook with an arbitrary filename as an attachment. NOTE: it is not clear whether this issue is implementation-specific or a problem in the Microsoft API.
- Record
EUVD-2006-2059- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qc6x-g3h2-596q No score
Argument injection vulnerability in Avant Browser 10.1 Build 17 allows user-assisted remote...
Argument injection vulnerability in Avant Browser 10.1 Build 17 allows user-assisted remote attackers to modify command line arguments to an invoked mail client via " (double quote) characters in a mailto: scheme handler, as demonstrated by launching Microsoft Outlook with an arbitrary filename as an attachment. NOTE: it is not clear whether this issue is implementation-specific or a problem in the Microsoft API.
- Record
GHSA-qc6x-g3h2-596q- Weakness
- CWE-88
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-2058 is a medium vulnerability (CVSS 5.0) in Avantbrowser Avant Browser, published April 26, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.82%, the 78th percentile. No source names a fixed version.
References
vupen.com/english/advisories/2006/1538
ingehenriksen.blogspot.com/2006/04/office-2003-file-attachment-exploit.html
securityfocus.com/archive/1/432009/100/0/threaded
securityreason.com/securityalert/785
exchange.xforce.ibmcloud.com/vulnerabilities/26118
nvd.nist.gov/vuln/detail/CVE-2006-2058
github.com/advisories/GHSA-qc6x-g3h2-596q