CVE-2006-3873

CVE-2006-3873 describes a heap-based buffer overflow in URLMON.DLL affecting Microsoft Internet Explorer 6 SP1 on Windows 2000 and XP SP1, specifically versions with the MS06-042 patch prior to September 12, 2006. This vulnerability, an incomplete fix for a previous flaw, allows remote attackers to trigger a denial of service or execute arbitrary code through a crafted, long URL within a GZIP-encoded website that is the target of an HTTP redirect. With a CVSS score of 7.5, it presents a high severity risk due to its network-based attack vector and low attack complexity, potentially leading to full compromise. While no public exploit code (Metasploit, Nuclei, ExploitDB) is listed, its high EPSS and FAUCET Risk Scores, along with community discussion and media coverage, indicate significant historical attention, though it is not currently on the CISA KEV or Hot List.