CVE-2006-2055

medium Microsoft
CVSS v3 Base Score
5.0
AV:N/AC:L/Au:N/C:P/I:N/A:N
EPSS Score
21.0%
Exploitation probability in 30 days
Top 4% most likely to be exploited
Attack Characteristics
Attack Vector
Network
Attack Complexity
Low
Confidentiality
P
Integrity
None
Availability
None
Published: April 26, 2006 (7322 days ago)
Last Modified: April 16, 2026
Vendor: Microsoft
Source: NVD

Description

Argument injection vulnerability in Microsoft Outlook 2003 SP1 allows user-assisted remote attackers to modify command line arguments to an invoked mail client via " (double quote) characters in a mailto: scheme handler, as demonstrated by launching Microsoft Outlook with an arbitrary filename as an attachment. NOTE: it is not clear whether this issue is implementation-specific or a problem in the Microsoft API.

CWE

CWE-88

Affected Products

microsoft outlook

References

🔗 ingehenriksen.blogspot.com 🔗 secunia.com 🔗 www.osvdb.org 🔗 www.securityfocus.com 🔗 www.vupen.com