← Vulnerability feed

Vulnerability record · CVE-2006-6134 · published 28 November 2006

CVE-2006-6134: Microsoft windows media player memory buffer overflow vulnerability

Microsoft · Windows Media Player

Heap-based buffer overflow in the WMCheckURLScheme function in WMVCORE.DLL in Microsoft Windows Media Player (WMP) 10.00.00.4036 on Windows XP SP2, Server 2003, and Server 2003 SP1 allows remote attackers to cause a denial of service (application crash) and execute arbitrary code via a long HREF attribute, using an unrecognized protocol, in a REF element in an ASX PlayList file.

7.5 CVSS 2.0 High EPSS 42% · top 1.4% CWE-119 · Memory buffer overflow
7.5CVSS 2.0 base score
42%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
30References, 2 tagged exploit
16 Jun 2026Last modified by NVD

Description

Heap-based buffer overflow in the WMCheckURLScheme function in WMVCORE.DLL in Microsoft Windows Media Player (WMP) 10.00.00.4036 on Windows XP SP2, Server 2003, and Server 2003 SP1 allows remote attackers to cause a denial of service (application crash) and execute arbitrary code via a long HREF attribute, using an unrecognized protocol, in a REF element in an ASX PlayList file.

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://blogs.technet.com/msrc/archive/2006/12/07/public-proof-of-concept-code-for-asx-file-format-isssue.aspx
http://research.eeye.com/html/alerts/zeroday/20061122.html
http://secunia.com/advisories/22971 Vendor Advisory
http://securityreason.com/securityalert/1922
http://securitytracker.com/id?1017354
http://support.avaya.com/elmodocs2/security/ASA-2006-274.htm
http://www.kb.cert.org/vuls/id/208769 US Government Resource
http://www.securityfocus.com/archive/1/452352/100/0/threaded
http://www.securityfocus.com/archive/1/453579/100/0/threaded
http://www.securityfocus.com/archive/1/454969/100/200/threaded
http://www.securityfocus.com/bid/21247 Exploit
http://www.us-cert.gov/cas/techalerts/TA06-346A.html US Government Resource
http://www.vupen.com/english/advisories/2006/4882 Vendor Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-078
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A669
http://blogs.technet.com/msrc/archive/2006/12/07/public-proof-of-concept-code-for-asx-file-format-isssue.aspx
http://research.eeye.com/html/alerts/zeroday/20061122.html
http://secunia.com/advisories/22971 Vendor Advisory
http://securityreason.com/securityalert/1922
http://securitytracker.com/id?1017354
http://support.avaya.com/elmodocs2/security/ASA-2006-274.htm
http://www.kb.cert.org/vuls/id/208769 US Government Resource
http://www.securityfocus.com/archive/1/452352/100/0/threaded
http://www.securityfocus.com/archive/1/453579/100/0/threaded
http://www.securityfocus.com/archive/1/454969/100/200/threaded
http://www.securityfocus.com/bid/21247 Exploit
http://www.us-cert.gov/cas/techalerts/TA06-346A.html US Government Resource
http://www.vupen.com/english/advisories/2006/4882 Vendor Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-078
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A669

Track CVE-2006-6134 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2008-3009Microsoft windows media player vulnerabilityMicrosoft Windows Media Player 6.4, Windows Media Format Runtime 7.1 through 11, and Windows Media Services 4.1, 9, and 2008 do not properly use the …EPSS 16%10.0CVE-2008-3010Microsoft windows media player information exposure vulnerabilityMicrosoft Windows Media Player 6.4, Windows Media Format Runtime 7.1 through 11, and Windows Media Services 4.1 and 9 incorrectly associate ISATAP ad…EPSS 15%10.0CVE-2004-0597libpng PNG chunk buffer overflows allow remote code executionlibpng 1.2.5 and earlier contain multiple buffer overflows in the png_handle_tRNS, png_handle_sBIT and png_handle_hIST functions, which fail to valid…EPSS 83%analysed9.3CVE-2015-1728Microsoft windows media player vulnerabilityMicrosoft Windows Media Player 10 through 12 allows remote attackers to execute arbitrary code via a crafted DataObject on a web site, aka "Windows M…EPSS 18%9.3CVE-2013-3127Microsoft windows media format runtime code injection vulnerabilityThe Microsoft WMV video codec in wmv9vcm.dll, wmvdmod.dll in Windows Media Format Runtime 9 and 9.5, and wmvdecod.dll in Windows Media Format Runtime…EPSS 22%9.3CVE-2010-2745Microsoft windows media player code injection vulnerabilityMicrosoft Windows Media Player (WMP) 9 through 12 does not properly deallocate objects during a browser reload action, which allows user-assisted rem…EPSS 24%9.3CVE-2010-3138Microsoft windows media player vulnerabilityUntrusted search path vulnerability in the Indeo Codec in iac25_32.ax in Microsoft Windows XP SP3 allows local users to gain privileges via a Trojan …EPSS 27%9.3CVE-2010-0268Microsoft windows media player vulnerabilityUnspecified vulnerability in the Windows Media Player ActiveX control in Windows Media Player (WMP) 9 on Microsoft Windows 2000 SP4 and XP SP2 and SP…EPSS 20%

Source: NIST National Vulnerability Database (record CVE-2006-6134), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.