CVE-2006-6696: Double free vulnerability in Microsoft Windows 2000, XP, 2003, and Vista allows local users to gain privileges by calling the MessageBox function with a MB_SERVICE_NOTIFICATION…

Unscored severity · published Dec 22, 2006

CVE-2006-6696

Double free vulnerability in Microsoft Windows 2000, XP, 2003, and Vista allows local users to gain privileges by calling the MessageBox function with a MB_SERVICE_NOTIFICATION…

–

CVSS

3.4%

EPSS

On KEV

Description

Double free vulnerability in Microsoft Windows 2000, XP, 2003, and Vista allows local users to gain privileges by calling the MessageBox function with a MB_SERVICE_NOTIFICATION message with crafted data, which sends a HardError message to Client/Server Runtime Server Subsystem (CSRSS) process, which is not properly handled when invoking the UserHardError and GetHardErrorText functions in WINSRV.DLL.

Exploitation

Is it being used?

Exploit prediction (EPSS)3.4% · higher than 89% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Windows 2000 · Microsoft

All versions, or not specified · source: NVD

Windows 2003 Server · Microsoft

datacenter_edition; datacenter_edition; datacenter_edition; enterprise_edition; enterprise_edition; sp1; +6 more · source: NVD