CVE-2006-3357
Heap-based buffer overflow in HTML Help ActiveX control (hhctrl.ocx) in Microsoft Internet...
Heap-based buffer overflow in HTML Help ActiveX control (hhctrl.ocx) in Microsoft Internet Explorer 6.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code by repeatedly setting the Image field of an Internet.HHCtrl.1 object to certain values, possibly related to improper escaping and long strings.
Exploit likelihood
What each source reports
NVD Score used
Heap-based buffer overflow in HTML Help ActiveX control (hhctrl.ocx) in Microsoft Internet Explorer 6.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code by repeatedly setting the Image field of an Internet.HHCtrl.1 object to certain values, possibly related to improper escaping and long strings.
- Record
CVE-2006-3357- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Heap-based buffer overflow in HTML Help ActiveX control (hhctrl.ocx) in Microsoft Internet Explorer 6.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code by repeatedly setting the Image field of an Internet.HHCtrl.1 object to certain values, possibly related to improper escaping and long strings.
- Record
CVE-2006-3357- Updated
- 2026-11-02
EUVDEUVD-2006-3354 No score
Heap-based buffer overflow in HTML Help ActiveX control (hhctrl.ocx) in Microsoft Internet Explorer 6.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code by repeatedly setting the Image field of an Internet.HHCtrl.1 object to certain values, possibly related to improper escaping and long strings.
- Record
EUVD-2006-3354- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9862-cg6x-84h4 No score
Heap-based buffer overflow in HTML Help ActiveX control (hhctrl.ocx) in Microsoft Internet...
Heap-based buffer overflow in HTML Help ActiveX control (hhctrl.ocx) in Microsoft Internet Explorer 6.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code by repeatedly setting the Image field of an Internet.HHCtrl.1 object to certain values, possibly related to improper escaping and long strings.
- Record
GHSA-9862-cg6x-84h4- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-3357 is a high vulnerability (CVSS 7.5) in Microsoft Internet Explorer, published July 6, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 35.3%, the 98th percentile. No source names a fixed version.
References
securitytracker.com/id?1016434
docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-046
kb.cert.org/vuls/id/159220
vupen.com/english/advisories/2006/2634
exchange.xforce.ibmcloud.com/vulnerabilities/27573
securityfocus.com/archive/1/442733/100/0/threaded
Show 10 moreShow less
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13
osvdb.org/26835
us-cert.gov/cas/techalerts/TA06-220A.html
tippingpoint.com/security/advisories/TSRT-06-08.html
secunia.com/advisories/20906
browserfun.blogspot.com/2006/07/mobb-2-internethhctrl-image-property.html
nvd.nist.gov/vuln/detail/CVE-2006-3357
github.com/advisories/GHSA-9862-cg6x-84h4