Vulnerability record · CVE-2006-4446 · published 30 August 2006
CVE-2006-4446: Internet Explorer DirectAnimation PathControl COM object heap buffer overflow
Microsoft · Ie
The DirectAnimation.PathControl COM object (daxctle.ocx) in Microsoft Internet Explorer 6.0 SP1 contains a heap-based buffer overflow. A Spline function call whose first argument specifies a large number of points overflows the heap, allowing a remote attacker to crash the browser and possibly execute arbitrary code.
Description
Heap-based buffer overflow in DirectAnimation.PathControl COM object (daxctle.ocx) in Microsoft Internet Explorer 6.0 SP1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a Spline function call whose first argument specifies a large number of points.
AV:N/AC:L/Au:N/C:N/I:N/A:P
Automated analysis
high priorityRemote, unauthenticated browser flaw with public exploit references and very high EPSS, though the record's CVSS 2.0 score is only 5.0 and code execution is described as possible rather than confirmed.
What it is
The DirectAnimation.PathControl COM object (daxctle.ocx) in Microsoft Internet Explorer 6.0 SP1 contains a heap-based buffer overflow. A Spline function call whose first argument specifies a large number of points overflows the heap, allowing a remote attacker to crash the browser and possibly execute arbitrary code.
Impact
An attacker can cause a denial of service and potentially execute arbitrary code in the context of the IE process. The CVSS 2.0 vector rates confidentiality and integrity impact as none and availability as partial, so the record's own scoring treats code execution as unconfirmed.
Attack surface
Reached over the network with no authentication required (AV:N/AC:L/Au:N), typically by luring a user to a malicious web page that instantiates the DirectAnimation control. User interaction in the form of visiting the page is implied by the browser-based vector, though the record does not state it explicitly.
Exploitation
Not listed in CISA KEV and no ransomware associations are recorded, but one SecurityFocus reference is tagged Exploit and EPSS shows a 30-day probability of 0.62238 (99.1st percentile), indicating exploit code is likely public and exploitation is plausible.
What to do
- Apply Microsoft security bulletin MS06-067, which addresses this vulnerability, or upgrade to a supported Internet Explorer version.
- Disable or block the DirectAnimation PathControl COM object (daxctle.ocx) via the kill-bit mechanism or IE security zone settings.
- Restrict browsing to trusted sites and enforce network controls that block untrusted content reaching legacy IE installations.
- Retire Internet Explorer 6.0 SP1, which is long out of support, in favor of a current browser.
Detection
- Monitor for IE processes loading daxctle.ocx, especially from unexpected paths or after visiting untrusted sites.
- Alert on IE crashes or heap corruption events correlated with pages containing DirectAnimation or Spline calls.
- Hunt proxy and DNS logs for access to known exploit-hosting or malicious pages referenced in threat intelligence.
- Use the OVAL definition org.mitre.oval:def:437 to check host patch state for MS06-067.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2006-4446 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2006-4446), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
