CVE-2006-2492

A malformed object pointer vulnerability in Microsoft Word allowed remote code execution and was actively exploited in the wild.

This CVE-2006-2492 flaw in Microsoft Word and Works Suites let attackers execute arbitrary code via malformed object pointers. DIB organizations must care because it was listed in CISA's KEV catalog, proving it was actively exploited, and it directly enables remote code execution (RCE). The failure stems from unpatched, long-standing vulnerabilities that attackers leveraged for years, highlighting the severe compliance and operational risks of relying on unpatched software.

Shame score — A known, unpatched RCE vulnerability in a ubiquitous productivity tool was actively exploited in the wild for years, demonstrating severe negligence in patch management and reliance on outdated software.