Note: This page is part of the archive.

This document is part of the US-CERT website archive. These documents are no longer updated and may contain outdated information. Links may also no longer function. Please contact if you have any questions about the US-CERT website archive.

Alert (TA06-262A)

Microsoft Internet Explorer VML Buffer Overflow

Systems Affected

  • Microsoft Windows
  • Microsoft Internet Explorer


Microsoft Internet Explorer (IE) fails to properly handle Vector Markup Language (VML) tags. This creates a buffer overflow vulnerability that could allow a remote attacker to execute arbitrary code.


Microsoft Internet Explorer contains a stack buffer overflow in code that handles VML. More information is available in Vulnerability Note VU#416092, Microsoft Security Advisory (925568), and Microsoft Security Bulletin MS06-055.

Note that this vulnerability is being exploited.


By convincing a user to open a specially crafted HTML document, such as a web page or HTML email message, a remote attacker could execute arbitrary code with the privileges of the user running IE.


Apply update from Microsoft

Microsoft has provided an update to correct this vulnerability in Microsoft Security Bulletin MS06-055.

This update is available on the Microsoft Update site.

System administrators may wish to consider using Windows Server Update Services (WSUS).

Disable VML support

Microsoft Security Advisory (925568) suggests the following techniques to disable VML support:

  • Un-register Vgx.dll on Windows XP Service Pack 1; Windows XP Service Pack 2; Windows Server 2003 and Windows Server 2003 Service Pack 1
  • Modify the Access Control List on Vgx.dll to be more restrictive
  • Configure Internet Explorer 6 for Microsoft Windows XP Service Pack 2 to disable Binary and Script Behaviors in the Internet and Local Intranet security zone
Disabling VML support may cause web sites and applications that use VML to function improperly.

Render email as plain text

Microsoft Security Advisory (925568) suggests configuring Microsoft Outlook and Outlook Express to render email messages in plain text format.

Do not follow unsolicited links

In order to convince users to visit their sites, attackers often use URL encoding, IP address variations, long URLs, intentional misspellings, and other techniques to create misleading links. Do not click on unsolicited links received in email, instant messages, web forums, or internet relay chat (IRC) channels. Type URLs directly into the browser to avoid these misleading links. While these are generally good security practices, following these behaviors will not prevent exploitation of this vulnerability in all cases, particularly if a trusted site has been compromised or allows cross-site scripting.


Revision History

  • September 19, 2006: Initial release
    September 21, 2006: Fixed misspelling and removed IE-specific language from Solution section
    September 26, 2006: Added update information and added a reference to Microsoft Update

This product is provided subject to this Notification and this Privacy & Use policy.

Was this document helpful?  Yes  |  Somewhat  |  No