What is CVE-2006-1016?

CVE-2006-1016 is a vulnerability in Microsoft Internet Explorer. Published 2006-03-07.

Is CVE-2006-1016 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Microsoft Internet Explorer

CVE-2006-1016

Buffer overflow in the IsComponentInstalled method in Internet Explorer 6.0, when used on Windows 2000 before SP4 or Windows XP before SP1, allows remote attackers to execute arbitrary code via JavaScript that calls IsComponentInstalled with a long first argument.

Published 2006-03-07 · last modified 2026-06-16.

CVSS v2 metric

CVSS v2 base score 7.5 (High). Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.

EPSS exploit prediction

EPSS: 0.670 (99.3th percentile), scored 2026-10-18.

High probability of exploitation in the next 30 days — patch promptly. 99th percentile — 99.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.670 · newest: 0.670 · change: 0.000

Affected products

Microsoft Internet Explorer — versions 6.0

Public proof-of-concept exploits

rapid7/metasploit-framework

References

www.securityfocus.com/bid/16870 (vdb-entry)
exchange.xforce.ibmcloud.com/vulnerabilities/24923 (vdb-entry)
metasploit.com/projects/Framework/exploits.html
www.metasploit.com/projects/Framework/modules/exploits/ie_iscomponentinstalled… (Exploit)

Frequently asked questions

What is CVE-2006-1016?: CVE-2006-1016 is a vulnerability in Microsoft Internet Explorer. Published 2006-03-07.
Is CVE-2006-1016 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.