CVE-2006-3650
Status: ModifiedHigh (9.3)—
Microsoft Office 2000, XP, 2003, 2004 for Mac, and v.X for Mac do not properly parse the length of a chart record, which allows remote user-assisted attackers to execute arbitrary code via a Word document with an embedded malformed chart record that triggers an overwrite of pointer values with values from the document, a different vulnerability than CVE-2006-3434, CVE-2006-3864, and CVE-2006-3868.
CVSS
- Version: 2.0
- Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
- Base score: 9.3
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 39%
- Percentile among all scored CVEs: 99
- Score date: 10/11/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
CWEs
- CWE-94
References
- http://secunia.com/advisories/22339
- http://securitytracker.com/id?1017034
- http://www.kb.cert.org/vuls/id/534276
- http://www.osvdb.org/29428
- http://www.securityfocus.com/archive/1/448151/100/0/threaded
- http://www.securityfocus.com/archive/1/449179/100/0/threaded
- http://www.securityfocus.com/bid/20383
- http://www.vupen.com/english/advisories/2006/3981
- http://www.zerodayinitiative.com/advisories/ZDI-06-034.html
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-062
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A222
- http://secunia.com/advisories/22339
- http://securitytracker.com/id?1017034
- http://www.kb.cert.org/vuls/id/534276
- http://www.osvdb.org/29428
- http://www.securityfocus.com/archive/1/448151/100/0/threaded
- http://www.securityfocus.com/archive/1/449179/100/0/threaded
- http://www.securityfocus.com/bid/20383
- http://www.vupen.com/english/advisories/2006/3981
- http://www.zerodayinitiative.com/advisories/ZDI-06-034.html
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-062
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A222
Raw JSON (NVD)
Show
{
"id": "CVE-2006-3650",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 9.3,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"authentication": "NONE",
"integrityImpact": "COMPLETE",
"accessComplexity": "MEDIUM",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": false,
"impactScore": 10,
"baseSeverity": "HIGH",
"obtainAllPrivilege": true,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
]
},
"affected": [
{
"source": "secure@microsoft.com",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2006-10-10T22:07:00.000",
"references": [
{
"url": "http://secunia.com/advisories/22339",
"tags": [
"Vendor Advisory"
],
"source": "secure@microsoft.com"
},
{
"url": "http://securitytracker.com/id?1017034",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "secure@microsoft.com"
},
{
"url": "http://www.kb.cert.org/vuls/id/534276",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"source": "secure@microsoft.com"
},
{
"url": "http://www.osvdb.org/29428",
"tags": [
"Broken Link"
],
"source": "secure@microsoft.com"
},
{
"url": "http://www.securityfocus.com/archive/1/448151/100/0/threaded",
"source": "secure@microsoft.com"
},
{
"url": "http://www.securityfocus.com/archive/1/449179/100/0/threaded",
"source": "secure@microsoft.com"
},
{
"url": "http://www.securityfocus.com/bid/20383",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "secure@microsoft.com"
},
{
"url": "http://www.vupen.com/english/advisories/2006/3981",
"tags": [
"Vendor Advisory"
],
"source": "secure@microsoft.com"
},
{
"url": "http://www.zerodayinitiative.com/advisories/ZDI-06-034.html",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "secure@microsoft.com"
},
{
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-062",
"source": "secure@microsoft.com"
},
{
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A222",
"tags": [
"Third Party Advisory"
],
"source": "secure@microsoft.com"
},
{
"url": "http://secunia.com/advisories/22339",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://securitytracker.com/id?1017034",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.kb.cert.org/vuls/id/534276",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.osvdb.org/29428",
"tags": [
"Broken Link"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/archive/1/448151/100/0/threaded",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/archive/1/449179/100/0/threaded",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/20383",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.vupen.com/english/advisories/2006/3981",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.zerodayinitiative.com/advisories/ZDI-06-034.html",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-062",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A222",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-94"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Microsoft Office 2000, XP, 2003, 2004 for Mac, and v.X for Mac do not properly parse the length of a chart record, which allows remote user-assisted attackers to execute arbitrary code via a Word document with an embedded malformed chart record that triggers an overwrite of pointer values with values from the document, a different vulnerability than CVE-2006-3434, CVE-2006-3864, and CVE-2006-3868."
},
{
"lang": "es",
"value": "Microsoft Office 2000, XP, 2003, 2004 para Mac, y v.X para Mac no analiza adecuadamente la longitud de un registro de un gráfico, lo cual permite a atacantes remotos con la intervención del usuario ejecutar código de su elección mediante un documento Word con un registro de gráfico mal formado que dispara la sobrescritura de los valores de punteros con valores del documento, una vulnerabilidad diferente que CVE-2006-3434, CVE-2006-3864, y CVE-2006-3868."
}
],
"lastModified": "2026-06-16T22:27:29.447",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:office:2000:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A9A82D13-513C-46FA-AF51-0582233E230A"
},
{
"criteria": "cpe:2.3:a:microsoft:office:2000:*:*:ja:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "757EC6C1-F5E2-45CD-9F7F-7760ECEDC842"
},
{
"criteria": "cpe:2.3:a:microsoft:office:2000:*:*:ko:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "59B1B68C-86F1-4FA4-9F82-3E8761ED1E74"
},
{
"criteria": "cpe:2.3:a:microsoft:office:2000:*:*:zh:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "716DDA05-D094-4837-852C-0511CDDD5ABC"
},
{
"criteria": "cpe:2.3:a:microsoft:office:2000:sp1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3C54DDAF-8D7F-4A7D-9186-6048D4C850B2"
},
{
"criteria": "cpe:2.3:a:microsoft:office:2000:sp2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "67388076-420D-4327-A436-329177EA6F42"
},
{
"criteria": "cpe:2.3:a:microsoft:office:2000:sp3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4891122F-AD7F-45E6-98C6-833227916F6B"
},
{
"criteria": "cpe:2.3:a:microsoft:office:2001:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "64B3099E-DFA0-4C7E-B016-370028BF8387"
},
{
"criteria": "cpe:2.3:a:microsoft:office:2001:*:*:*:*:mac_os:*:*",
"vulnerable": true,
"matchCriteriaId": "43AE142C-E7AD-418E-BA9B-887285EE9620"
},
{
"criteria": "cpe:2.3:a:microsoft:office:2001:sr1:*:*:*:mac_os:*:*",
"vulnerable": true,
"matchCriteriaId": "23E6544C-3695-45E6-A8AD-2F3A3B574915"
},
{
"criteria": "cpe:2.3:a:microsoft:office:2003:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DB7EA4CC-E705-42DB-86B6-E229DA36B66D"
},
{
"criteria": "cpe:2.3:a:microsoft:office:2003:sp1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4EED9D78-AE73-44BA-A1CE-603994E92E89"
},
{
"criteria": "cpe:2.3:a:microsoft:office:2003:sp2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "07D3F3E4-93FB-481A-94D9-075E726697C4"
},
{
"criteria": "cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A332D04D-CC8C-4F68-A261-BA2F2D8EAD1E"
},
{
"criteria": "cpe:2.3:a:microsoft:office:2004:*:*:*:*:mac_os:*:*",
"vulnerable": true,
"matchCriteriaId": "C548E35A-C9DF-4784-824A-EEBB693CD388"
},
{
"criteria": "cpe:2.3:a:microsoft:office:v.x:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "310DF9B3-3494-4BD4-8A9D-82211EA6C518"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "secure@microsoft.com"
}