CVE-2006-3654: Microsoft Works Spreadsheet wksss.exe buffer overflow via crafted Excel file

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

low priorityThe CVSS 2.0 score is 2.6 (LOW) with only availability impact, and the record shows no confirmed active exploitation despite public exploit material.

What it is

A buffer overflow exists in wksss.exe 8.4.702.0 in Microsoft Works Spreadsheet 8.0 when processing crafted Excel files. The flaw is reachable remotely and can crash the process or consume CPU, giving a denial of service. The record is old and thin: no patch reference, no affected-version list beyond the stated build, and no vendor advisory is included.

Impact

An attacker can cause a denial of service, crashing the spreadsheet process or exhausting CPU. The CVSS vector shows no confidentiality or integrity impact, so no data theft or code execution is claimed by the record.

Attack surface

Reached over the network by delivering a crafted Excel file that the victim opens in Works Spreadsheet; the vector AV:N/AC:H/Au:N indicates no authentication is required but exploitation is difficult and likely needs user interaction to open the file.

Exploitation

Not listed in CISA KEV. EPSS is 0.4785 (98.8th percentile), and one reference carries an Exploit tag, indicating public exploit material exists, though the record does not confirm active exploitation.

What to do

• Apply the vendor fix for Works Spreadsheet if one exists; the record provides no patch reference, so check Microsoft's advisory history for this build.
• Block or strip untrusted Excel attachments at the mail and web gateway before they reach Works Spreadsheet.
• Remove or isolate Works Spreadsheet 8.0 on hosts that do not need it, since the product is long out of support.
• Open untrusted spreadsheets only in a sandboxed or non-production environment.

Detection

• Monitor for wksss.exe crashes or abnormal CPU spikes correlated with opening Excel files.
• Alert on Excel attachments arriving from external senders to users running Works Spreadsheet.
• Review endpoint logs for repeated wksss.exe process termination events on the same host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.