← Vulnerability feed

Vulnerability record · CVE-2006-3438 · published 9 August 2006

CVE-2006-3438: Microsoft hyperlink object library vulnerability

Microsoft · Hyperlink Object Library

Unspecified vulnerability in Microsoft Hyperlink Object Library (hlink.dll), possibly a buffer overflow, allows user-assisted attackers to execute arbitrary code via crafted hyperlinks that are not properly handled when hlink.dll "uses a file containing a malformed function," aka "Hyperlink Object Function Vulnerability."

9.3 CVSS 2.0 High EPSS 12% · top 4.0%
9.3CVSS 2.0 base score
12%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
12References
16 Jun 2026Last modified by NVD

Description

Unspecified vulnerability in Microsoft Hyperlink Object Library (hlink.dll), possibly a buffer overflow, allows user-assisted attackers to execute arbitrary code via crafted hyperlinks that are not properly handled when hlink.dll "uses a file containing a malformed function," aka "Hyperlink Object Function Vulnerability."

AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://securitytracker.com/id?1016659
http://www.kb.cert.org/vuls/id/683612 PatchUS Government Resource
http://www.securityfocus.com/bid/19405
http://www.us-cert.gov/cas/techalerts/TA06-220A.html PatchUS Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-050
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A115
http://securitytracker.com/id?1016659
http://www.kb.cert.org/vuls/id/683612 PatchUS Government Resource
http://www.securityfocus.com/bid/19405
http://www.us-cert.gov/cas/techalerts/TA06-220A.html PatchUS Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-050
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A115

Track CVE-2006-3438 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.3CVE-2006-3086Microsoft Hyperlink Object Library hlink.dll stack buffer overflowThe HrShellOpenWithMonikerDisplayName function in Microsoft's Hyperlink Object Library (hlink.dll) has a stack-based buffer overflow triggered by an …EPSS 56%analysed

Source: NIST National Vulnerability Database (record CVE-2006-3438), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.