CVE-2006-0008

The ShellAbout API call in Korean Input Method Editor (IME) in Korean versions of Microsoft Windows XP SP1 and SP2, Windows Server 2003 up to SP1, and Office 2003, allows local users to gain privileges by launching the "shell about dialog box" and clicking the "End-User License Agreement" link, which executes Notepad with the privileges of the program that displays the about box.

Published: 2006-02-14 Last update: 2026-06-16 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2006-0008 is rated Moderate Risk (55.4/100): CVSS High severity, with medium exploitation likelihood (EPSS 1.66%). Review affected assets and schedule remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2006-0008

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-15 0.79% 1.66% +0.87%
2 2026-03-15 0.58% 0.79% +0.21%
3 2025-11-12 — 0.58% —

Full EPSS history (9 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2006-0008

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
7.2 2.0 HIGH
AV:L/AC:L/Au:N/C:C/I:C/A:C Click to expand
Access vector (AV:L)
Requires local access to the target system.
Access complexity (AC:L)
Exploitation conditions are straightforward and predictable.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:C)
Complete confidentiality impact.
Integrity impact (I:C)
Complete integrity impact.
Availability impact (A:C)
Complete availability impact.
 3.9 10.0 [email protected]

Weakness enumeration for CVE-2006-0008

Affected software / configurations for CVE-2006-0008

Vendor Product Version Raw CPE
microsoft office 2003 cpe:2.3:a:microsoft:office:2003:*:*:*:*:*:*:*
microsoft office 2003 cpe:2.3:a:microsoft:office:2003:sp1:*:*:*:*:*:*
microsoft office 2003 cpe:2.3:a:microsoft:office:2003:sp2:*:*:*:*:*:*
microsoft windows_2003_server datacenter_64-bit cpe:2.3:o:microsoft:windows_2003_server:datacenter_64-bit:sp1:*:*:*:*:*:*
microsoft windows_2003_server enterprise cpe:2.3:o:microsoft:windows_2003_server:enterprise:*:64-bit:*:*:*:*:*
microsoft windows_2003_server enterprise cpe:2.3:o:microsoft:windows_2003_server:enterprise:sp1:*:*:*:*:*:*
microsoft windows_2003_server enterprise_64-bit cpe:2.3:o:microsoft:windows_2003_server:enterprise_64-bit:*:*:*:*:*:*:*
microsoft windows_2003_server enterprise_64-bit cpe:2.3:o:microsoft:windows_2003_server:enterprise_64-bit:sp1:*:*:*:*:*:*
microsoft windows_2003_server r2 cpe:2.3:o:microsoft:windows_2003_server:r2:*:64-bit:*:*:*:*:*
microsoft windows_2003_server r2 cpe:2.3:o:microsoft:windows_2003_server:r2:*:datacenter_64-bit:*:*:*:*:*
microsoft windows_2003_server r2 cpe:2.3:o:microsoft:windows_2003_server:r2:sp1:*:*:*:*:*:*
microsoft windows_2003_server standard cpe:2.3:o:microsoft:windows_2003_server:standard:*:64-bit:*:*:*:*:*
microsoft windows_2003_server standard cpe:2.3:o:microsoft:windows_2003_server:standard:sp1:*:*:*:*:*:*
microsoft windows_2003_server standard_64-bit cpe:2.3:o:microsoft:windows_2003_server:standard_64-bit:*:*:*:*:*:*:*
microsoft windows_2003_server web cpe:2.3:o:microsoft:windows_2003_server:web:*:*:*:*:*:*:*
microsoft windows_2003_server web cpe:2.3:o:microsoft:windows_2003_server:web:sp1:*:*:*:*:*:*
microsoft windows_xp — cpe:2.3:o:microsoft:windows_xp:*:*:64-bit:*:*:*:*:*
microsoft windows_xp — cpe:2.3:o:microsoft:windows_xp:*:*:home:*:*:*:*:*
microsoft windows_xp — cpe:2.3:o:microsoft:windows_xp:*:*:media_center:*:*:*:*:*
microsoft windows_xp — cpe:2.3:o:microsoft:windows_xp:*:gold:professional:*:*:*:*:*
microsoft windows_xp — cpe:2.3:o:microsoft:windows_xp:*:sp1:home:*:*:*:*:*
microsoft windows_xp — cpe:2.3:o:microsoft:windows_xp:*:sp1:media_center:*:*:*:*:*
microsoft windows_xp — cpe:2.3:o:microsoft:windows_xp:*:sp2:home:*:*:*:*:*
microsoft windows_xp — cpe:2.3:o:microsoft:windows_xp:*:sp2:media_center:*:*:*:*:*
microsoft windows_xp — cpe:2.3:o:microsoft:windows_xp:*:sp2:tablet_pc:*:*:*:*:*

References for CVE-2006-0008

URL Tags
http://secunia.com/advisories/18859 Patch Vendor Advisory
http://securitytracker.com/id?1015631 Patch
http://www.kb.cert.org/vuls/id/739844 Third Party Advisory US Government Resource
http://www.ryanstyle.com/alert/my/5/ms06_009_eng.html Vendor Advisory
http://www.securityfocus.com/archive/1/425141/100/0/threaded
http://www.securityfocus.com/bid/16643 Patch
http://www.vupen.com/english/advisories/2006/0578 Vendor Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-009
https://exchange.xforce.ibmcloud.com/vulnerabilities/24492
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1595
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1650
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1664
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1688
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A727
cvelogic Threat Intelligence