CVE-2006-2480

CVE-2006-2480 describes a format string vulnerability in Dia 0.94, a diagramming software. This flaw allows user-assisted attackers to trigger a denial of service (crash) and potentially execute arbitrary code by embedding format string specifiers in filenames, such as a .bmp file. The vulnerability has a CVSS score of 5.1, indicating a medium severity, with a network attack vector and high attack complexity, leading to potential partial confidentiality, integrity, and availability impacts. While there is no evidence of active exploitation, exploit code is publicly available through ExploitDB, and the vulnerability has received minimal community discussion or media coverage.