CVE-2006-6696
Double free vulnerability in Microsoft Windows 2000, XP, 2003, and Vista allows local users to gain privileges by calling the MessageBox…
- 6.9MediumCVSS base score
- 3.4%Exploitation in 30 daysEPSS · top 11% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- 2Public exploitsMetasploit, Nuclei and Exploit-DB
Description
Double free vulnerability in Microsoft Windows 2000, XP, 2003, and Vista allows local users to gain privileges by calling the MessageBox function with a MB_SERVICE_NOTIFICATION message with crafted data, which sends a HardError message to Client/Server Runtime Server Subsystem (CSRSS) process, which is not properly handled when invoking the UserHardError and GetHardErrorText functions in WINSRV.DLL.
Public exploit
An exploit or proof of concept is public: anyone can try it against an unpatched system. The public collections list 2 Exploit-DB entries for it.
Show the exploits2
Exploit-DB2 entries
- Microsoft Windows - NtRaiseHardError 'Csrss.exe' Memory Disclosure (Exploit-DB entry) (opens in a new tab)
EDB-ID 3024local, windowspublished 27 Dec 2006Verified
- Microsoft Windows - 'MessageBox' Memory Corruption Local Denial of Service (Exploit-DB entry) (opens in a new tab)
EDB-ID 2967dos, windowspublished 20 Dec 2006Verified
Modules, templates and exploits as listed by the Metasploit Framework (BSD-3-Clause), ProjectDiscovery's Nuclei templates (MIT) and the Exploit Database (GPLv2), read once a day. Where the data comes from
Timeline
ID reserved
By mitre
- 1 day later
· 1 day later
Published
- 18 years later
· 18 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 2.0 | Medium6.9 | AV:L/AC:M/Au:N/C:C/I:C/A:C |
- EPSS (exploitation in 30 days)
- 3.4% · top 11% of all CVEs (11 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.9.
Affected products
n/a
- affected n/a
References
23
- http://www.kuban.ru/forum_new/forum2/files/19124.html (opens in a new tab)x_refsource_MISCx_transferred
- 20061230 csrss.exe double-free vulnerability - arbitrary DWORD overwrite exploit (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
- HPSBST02208 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
- 1017433 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
- http://groups.google.ca/group/microsoft.public.win32.programmer.kernel/browse_thread/thread/c5946bf40f227058/7bd7b5d66a4e5aff (opens in a new tab)x_refsource_MISCx_transferred
- http://www.security.nnov.ru/Gnews944.html (opens in a new tab)x_refsource_MISCx_transferred
- http://research.eeye.com/html/alerts/zeroday/20061215.html (opens in a new tab)x_refsource_MISCx_transferred
- http://www.determina.com/security.research/vulnerabilities/csrss-harderror.html (opens in a new tab)x_refsource_MISCx_transferred
- 20061221 Re: [Full-disclosure] Microsoft Windows XP/2003/Vista memorycorruption 0day (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
- http://blogs.technet.com/msrc/archive/2006/12/22/new-report-of-a-windows-vulnerability.aspx (opens in a new tab)x_refsource_CONFIRMx_transferred
- 20061222 Re: Re: [Full-disclosure] Microsoft Windows XP/2003/Vista memory corruption 0day (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
- 21688 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
- MS07-021 (opens in a new tab)vendor-advisoryx_refsource_MSx_transferred
- oval:org.mitre.oval:def:1816 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
- ADV-2007-1325 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
- http://www.security.nnov.ru/files/messagebox.c (opens in a new tab)x_refsource_MISCx_transferred
- 20061221 Microsoft Windows XP/2003/Vista memory corruption 0day (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred
- 23324 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
- 20061221 Re: [Full-disclosure] Microsoft Windows XP/2003/Vista memory corruption 0day (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
- 20061221 Microsoft Windows XP/2003/Vista memory corruption 0day (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
- 23448 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- http://isc.sans.org/diary.php?n&storyid=1965 (opens in a new tab)x_refsource_MISCx_transferred
- ADV-2006-5120 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2006-6679 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2006-6696)Record last updated .