Vulnerability record · CVE-2006-1186 · published 11 April 2006
CVE-2006-1186: Internet Explorer ActiveX COM object instantiation memory corruption
Microsoft · Ie
Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code by instantiating the Mdt2gddr.dll, Mdt2dd.dll, and Mdt2gddo.dll COM objects as ActiveX controls, causing memory corruption. The flaw is remotely reachable and requires no authentication, so a crafted page can compromise a browsing user. It matters because IE was widely deployed and the flaw yields full code execution in the user's context.
Description
Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via by instantiating the (1) Mdt2gddr.dll, (2) Mdt2dd.dll, and (3) Mdt2gddo.dll COM objects as ActiveX controls, which leads to memory corruption.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
critical priorityCVSS 2.0 base score is 10 with network reachability, no authentication and full code execution, and EPSS is at the 99th percentile.
What it is
Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code by instantiating the Mdt2gddr.dll, Mdt2dd.dll, and Mdt2gddo.dll COM objects as ActiveX controls, causing memory corruption. The flaw is remotely reachable and requires no authentication, so a crafted page can compromise a browsing user. It matters because IE was widely deployed and the flaw yields full code execution in the user's context.
Impact
An attacker gains arbitrary code execution with the privileges of the logged-on user, allowing installation of malware, data theft or further lateral movement. The CVSS 2.0 vector shows complete confidentiality, integrity and availability impact.
Attack surface
Reached over the network via a web page or HTML document that instantiates the affected ActiveX COM objects in Internet Explorer; no authentication is required. User interaction is implied by the browser-based vector, though the record does not state it explicitly.
Exploitation
Not listed in CISA KEV and no ransomware usage is documented; EPSS is 0.57927 (99th percentile), indicating high predicted exploitation likelihood. Reference tags include Patch and Vendor Advisory, and Microsoft security bulletin MS06-013 is cited, but no public exploit code is confirmed in the record.
What to do
- Apply Microsoft security bulletin MS06-013 (April 2006 cumulative IE update) or later IE patches immediately.
- Disable or kill-bit the Mdt2gddr.dll, Mdt2dd.dll and Mdt2gddo.dll COM objects in Internet Explorer.
- Restrict ActiveX execution in IE via zone and ActiveX security settings, and block untrusted sites.
- Migrate users off Internet Explorer 5.01/6 to a supported browser.
- Enforce least privilege so browsing users cannot install software or persist code.
Detection
- Monitor for IE processes loading Mdt2gddr.dll, Mdt2dd.dll or Mdt2gddo.dll, especially from unusual paths.
- Hunt for IE crashes or memory-corruption events correlated with visits to untrusted sites.
- Alert on child processes spawned by iexplore.exe, a common post-exploitation signal.
- Review proxy and web logs for pages referencing the affected ActiveX controls.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2006-1186 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2006-1186), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
