CVE-2006-2909

CVE-2006-2909 describes a stack-based buffer overflow in PicoZip 4.01's info tip shell extension (zipinfo.dll). This vulnerability allows remote attackers to execute arbitrary code by crafting an archive (ACE, RAR, or ZIP) with an excessively long filename, which triggers when a user hovers their mouse over the malicious file. With a CVSS score of 7.5, it is considered highly severe due to its network-based attack vector and low attack complexity, potentially leading to partial confidentiality, integrity, and availability compromise. While not listed on CISA's KEV catalog, an exploit is publicly available on ExploitDB, though there is no evidence of active exploitation, Metasploit modules, or significant community discussion.