CVE-2006-3471

Status: ModifiedMedium (5)—Exploit

Severity5Medium · CVSS 2.0

Exploitation probability21 %higher than 98% of CVEs

Active exploitationNonot in the CISA catalog

Public exploitAvailablePublished on Exploit-DB

Microsoft Internet Explorer 6 on Windows XP allows remote attackers to cause a denial of service (crash) via a table with a frameset as a child, which triggers a null dereference, as demonstrated using the appendChild method.

CVSS

Base score: 5
Version: 2.0
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 21 %
Percentile among all scored CVEs: 98
Score date: 10/23/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Public exploits

Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.

Published on Exploit-DB · Microsoft Internet Explorer 6 - Table.Frameset NULL Dereference (7/7/2006)

Affected technologies (1)

Microsoft — IE

CWEs

NVD-CWE-Other

References

Show 10 references

Raw JSON (NVD)

Show

{
  "id": "CVE-2006-3471",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2006-07-10T19:05:00.000",
  "references": [
    {
      "url": "http://browserfun.blogspot.com/2006/07/mobb-7-tableframeset.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.osvdb.org/26837",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/18873",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2006/2701",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27592",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://browserfun.blogspot.com/2006/07/mobb-7-tableframeset.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/26837",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/18873",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2006/2701",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27592",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Microsoft Internet Explorer 6 on Windows XP allows remote attackers to cause a denial of service (crash) via a table with a frameset as a child, which triggers a null dereference, as demonstrated using the appendChild method."
    },
    {
      "lang": "es",
      "value": "Microsoft Internet Explorer 6 en Windows XP, permite a atacantes remotos provocar una denegación de servicio (caída) a través de una tabla con un frameset (conjunto de marcos) como hijo, esto provoca una referencia nula, como se ha demostrado utilizando el método appendChild."
    }
  ],
  "lastModified": "2026-06-16T22:27:08.457",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:ie:6.0:*:windowsxp:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DACE76B0-02BC-4624-A21E-405A893D7437"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:ie:6.0:sp1:windows_xp:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BA04D0A1-23AE-4C0F-8FE3-FD88D75CDA03"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}