Skip to content
Fencer Vulns
critical 9.3

CVE-2006-3890 in the critical feed json

Stack-based buffer overflow in the Sky Software FileView ActiveX control, as used in WinZip 10 before build 7245 and in certain other appli…

published 2006-11-21 19 y ago modified 2026-06-16 4 mo ago also EUVD-2006-3884

cvss
9.3
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
14.6%
EPSS 14.6% chance of exploitation in 30 days, percentile 96%
public exploits
1
Exploit-DB

Summary

Stack-based buffer overflow in the Sky Software FileView ActiveX control, as used in WinZip 10 before build 7245 and in certain other applications, allows remote attackers to execute arbitrary code via a long FilePattern attribute in a WZFILEVIEW object, a different vulnerability than CVE-2006-5198.

Patch / fix

Timeline

  1. Published
  2. First public exploit (EDB-3420)

Exploit prediction

14.61% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-3420 WinZip 10.0.7245 - FileView ActiveX Buffer Overflow (2) remote, 2007-03-06
  • secunia.com http://secunia.com/advisories/22891 referenced PoC, tagged "exploit" by a source, unverified
  • securityfocus.com http://www.securityfocus.com/bid/21060 referenced PoC, tagged "exploit" by a source, unverified
  • exploit-db.com https://www.exploit-db.com/exploits/2785 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.