CVE-2006-3493

CVE-2006-3493 is a medium-severity vulnerability in Microsoft Office with a CVSS 2.0 base score of 5.1. Its EPSS exploit-prediction score of 40% places it in the 98th percentile, indicating an elevated likelihood of exploitation.

Key facts

Description

Buffer overflow in LsCreateLine function (mso_203) in mso.dll and mso9.dll, as used by Microsoft Word and possibly other products in Microsoft Office 2003, 2002, and 2000, allows remote user-assisted attackers to cause a denial of service (crash) via a crafted Word DOC or other Office file type. NOTE: this issue was originally reported to allow code execution, but on 20060710 Microsoft stated that code execution is not possible, and the original researcher agrees.

Frequently asked questions

What is CVE-2006-3493?
Buffer overflow in LsCreateLine function (mso_203) in mso.dll and mso9.dll, as used by Microsoft Word and possibly other products in Microsoft Office 2003, 2002, and 2000, allows remote user-assisted attackers to cause a denial of service (crash) via a crafted Word DOC or other Office file type. NOTE: this issue was originally reported to allow code execution, but on 20060710 Microsoft stated that code execution is not possible, and the original researcher agrees.
How severe is CVE-2006-3493?
CVE-2006-3493 has a CVSS 2.0 base score of 5.1, rated medium severity.
Is CVE-2006-3493 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 40% (98th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2006-3493?
CVE-2006-3493 primarily affects Microsoft Office. In total, 12 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2006-3493?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2006-3493 published?
CVE-2006-3493 was published on 2006-07-10 and last updated on 2026-06-16.

References

Affected products (12)

More vulnerabilities in Microsoft Office

All CVEs affecting Microsoft Office →