CVE-2006-3649

Buffer overflow in Microsoft Visual Basic for Applications (VBA) SDK 6.0 through 6.4, as used by Microsoft Office 2000 SP3, Office XP SP3, Project 2000 SR1, Project 2002 SP1, Access 2000 Runtime SP3, Visio 2002 SP2, and Works Suite 2004 through 2006, allows user-assisted attackers to execute arbitrary code via unspecified document properties that are not verified when VBA is invoked to open documents.

• http://secunia.com/advisories/21408
• http://securitytracker.com/id?1016656
• http://www.kb.cert.org/vuls/id/159484Patch, US Government Resource
• http://www.securityfocus.com/bid/19414
• http://www.us-cert.gov/cas/techalerts/TA06-220A.htmlPatch, US Government Resource
• http://www.vupen.com/english/advisories/2006/3214
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-047
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A694
• http://secunia.com/advisories/21408
• http://securitytracker.com/id?1016656
• http://www.kb.cert.org/vuls/id/159484Patch, US Government Resource
• http://www.securityfocus.com/bid/19414
• http://www.us-cert.gov/cas/techalerts/TA06-220A.htmlPatch, US Government Resource
• http://www.vupen.com/english/advisories/2006/3214
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-047
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A694

Published

Aug 9, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-3643Cross-site scripting (XSS) vulnerability in Internet Explore…
• CVE-2006-3644Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2006-3645Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2006-3646Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2006-3647Integer overflow in Microsoft Word 2000, 2002, 2003, 2004 fo…
• CVE-2006-3648Unspecified vulnerability in Microsoft Windows 2000 SP4, XP …
• CVE-2006-3650Microsoft Office 2000, XP, 2003, 2004 for Mac, and v.X for M…
• CVE-2006-3651Unspecified vulnerability in Microsoft Word 2000, 2002, and …
• CVE-2006-3652Microsoft Internet Security and Acceleration (ISA) Server 20…
• CVE-2006-3653wksss.exe 8.4.702.0 in Microsoft Works Spreadsheet 8.0 allow…
• CVE-2006-3654Buffer overflow in wksss.exe 8.4.702.0 in Microsoft Works Sp…
• CVE-2006-3655Unspecified vulnerability in mso.dll in Microsoft PowerPoint…