CVE-2006-0994

CVE-2006-0994 describes a heap corruption vulnerability in multiple Sophos Anti-Virus products, specifically versions 5.x before 5.2.1 and 4.x before 4.05, when cabinet file inspection is enabled. This critical flaw allows remote attackers to execute arbitrary code by crafting a malicious CAB file with invalid folder count values. With a CVSS score of 7.5, it presents a high risk due to its network-based attack vector, low attack complexity, and potential for complete compromise of confidentiality, integrity, and availability. While no active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion has been observed, its high FAUCET Risk Score of 96/100 and elevated EPSS score indicate a notable potential for future exploitation.