Vulnerability record · CVE-2006-3281 · published 28 June 2006
CVE-2006-3281: Internet Explorer 6 Drag and Drop HTA Code Execution
Microsoft · Internet Explorer
Microsoft Internet Explorer 6.0 mishandles Drag and Drop events, allowing a remote attacker to execute arbitrary code when a user drags a crafted link pointing to an SMB file share. The filename uses encoded directory traversal sequences and an extension containing the CLSID key identifier for HTML Applications (HTA), which triggers the code execution. This is a user-assisted flaw in a legacy browser, but it can lead to full system compromise if the user interacts with the malicious link.
Description
Microsoft Internet Explorer 6.0 does not properly handle Drag and Drop events, which allows remote user-assisted attackers to execute arbitrary code via a link to an SMB file share with a filename that contains encoded ..\ (%2e%2e%5c) sequences and whose extension contains the CLSID Key identifier for HTML Applications (HTA), aka "Folder GUID Code Execution Vulnerability." NOTE: directory traversal sequences were used in the original exploit, although their role is not clear.
AV:N/AC:H/Au:N/C:P/I:P/A:P
Automated analysis
medium priorityThe vulnerability affects a legacy browser and requires user interaction, but public exploit code exists and EPSS is high, making it a moderate risk for organizations still running Internet Explorer 6.
What it is
Microsoft Internet Explorer 6.0 mishandles Drag and Drop events, allowing a remote attacker to execute arbitrary code when a user drags a crafted link pointing to an SMB file share. The filename uses encoded directory traversal sequences and an extension containing the CLSID key identifier for HTML Applications (HTA), which triggers the code execution. This is a user-assisted flaw in a legacy browser, but it can lead to full system compromise if the user interacts with the malicious link.
Impact
An attacker can execute arbitrary code with the privileges of the logged-on user, potentially leading to complete system compromise. The CVSS 2.0 vector indicates partial confidentiality, integrity, and availability impact.
Attack surface
The vulnerability is reached remotely over the network via a crafted link to an SMB file share, requiring the user to perform a Drag and Drop action. No authentication is needed, but user interaction is required.
Exploitation
Public exploit code is referenced in the Full Disclosure attachment, and EPSS indicates a high probability of exploitation (0.48215, 98.8th percentile), though it is not listed in CISA KEV.
What to do
- Apply the vendor patch referenced in Microsoft Security Bulletin MS06-045.
- Disable or restrict Drag and Drop functionality in Internet Explorer where feasible.
- Block outbound SMB traffic (TCP 445) from client networks to untrusted hosts.
- Upgrade to a supported, modern browser that is not affected by this legacy flaw.
- Educate users about the risks of dragging links or content from untrusted sources.
Detection
- Monitor network traffic for SMB connections to external or untrusted IP addresses originating from user workstations.
- Audit process creation events for unexpected child processes spawned by Internet Explorer, especially those loading HTA or script content.
- Review file system and registry modifications associated with HTA execution or CLSID key abuse.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2006-3281 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2006-3281), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
