Summary
generated automatically from NVD dataCVE-2006-0002 is an unspecified vulnerability in Microsoft Outlook (2000 through 2003), Exchange Server (5.0 SP2, 5.5 SP4 and 2000 SP3) and Office, tied to message length validation. A remote attacker could send an e-mail with a crafted Transport Neutral Encapsulation Format (TNEF) MIME attachment and execute arbitrary code on the target. It carries a CVSS v2.0 score of 7.5 (HIGH), with network access, low complexity and no authentication required.
NVD description
Unspecified vulnerability in Microsoft Outlook 2000 through 2003, Exchange 5.0 Server SP2 and 5.5 SP4, Exchange 2000 SP3, and Office allows remote attackers to execute arbitrary code via an e-mail message with a crafted Transport Neutral Encapsulation Format (TNEF) MIME attachment, related to message length validation.
EPSS · FIRST.org
45.6%probability of exploitation in the next 30 days
Higher than 98% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-29, recomputed daily by FIRST.org.
CVSS v2.0 Score
Information
- Published
- 10 janv. 2006
- Updated
- 16 juin 2026
- Status
- Modified
- Source
- secure@microsoft.com
Affected products
Bounds published by NVD: "< 8.4.27" means 8.4.27 is no longer vulnerable. The fixed release to install is in the vendor advisory.
Weaknesses (CWE)
References (40)
- http://secunia.com/advisories/18368PatchThird Party Advisory
- http://securityreason.com/securityalert/330Third Party Advisory
- http://securityreason.com/securityalert/331Third Party Advisory
- http://securitytracker.com/id?1015460PatchThird Party AdvisoryVDB Entry
- http://securitytracker.com/id?1015461PatchThird Party AdvisoryVDB Entry
- http://support.avaya.com/elmodocs2/security/ASA-2006-004.htmThird Party Advisory
- http://www.kb.cert.org/vuls/id/252146Third Party AdvisoryUS Government Resource
- http://www.securityfocus.com/archive/1/421518/100/0/threadedThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/archive/1/421520/100/0/threadedThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/16197PatchThird Party AdvisoryVDB Entry
- http://www.us-cert.gov/cas/techalerts/TA06-010A.htmlPatchThird Party AdvisoryUS Government Resource
- http://www.vupen.com/english/advisories/2006/0119Permissions Required
- https://exchange.xforce.ibmcloud.com/vulnerabilities/22878Third Party AdvisoryVDB Entry
- + 25 more references on NVD
Similar CVEs
Other vulnerabilities of type
Know which CVEs hit the versions you run.
Add the product and its version: cveo.tech lists the CVEs that affect it right away, then alerts you by email when a new one affects it — including before NVD has finished its analysis. Free, an account is all it takes.