CVSS 9.3 CRITICAL Bulletin: MS06-005 Published: 2006-02-14

CVE-2006-0003: Microsoft Windows Media Player DirectShow BMP Rendering RCE

Technical intelligence and weaponization dossier for CVE-2006-0003. Documented exploitation across 4 active malware families totaling 162 analyzed telemetry samples.

Attributed Families

Sample Volume

162

CVSS Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Official NIST NVD

View NVD Record →

Vulnerability Specifications & Root Cause

Vulnerability ID	CVE-2006-0003
Common Name / Bulletin	Microsoft Windows Media Player DirectShow BMP Rendering RCE (`MS06-005`)
CWE Classification	`CWE-119: Heap Buffer Overflow in quartz.dll`
Affected Software & Versions	Microsoft Windows Media Player 9 and 10 on Windows 2000, XP, Server 2003
Technical Root Cause	Heap-based buffer overflow when parsing specially crafted bitmap (BMP) image headers embedded within media streams in DirectShow (quartz.dll), allowing drive-by code execution.
Associated ATT&CK Techniques	`T1204.002` — Associated ATT&CK Technique `T1189` — Associated ATT&CK Technique

Malware Families Weaponizing CVE-2006-0003

Empirical catalog telemetry verifies that the following 4 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:

4 families

Malware Family	Category	Catalog Samples	Operational Profile
hupigon	Rat	`146`	Backdoor:Win32/Hupigon (universally known in China as Huigezi, translated as 'Grey Pigeon') is a classic, historically legendary Chinese Remote Access Trojan (R...
sinowal	Banking Trojan	`13`	Trojan:Win32/Sinowal (widely documented in cybersecurity research as Torpig and its underlying MBR rootkit Mebroot) is a historic, landmark financial crimeware ...
rustock	Advanced Threat	`2`	Rootkit:Win32/Rustock (internally designated as Costrat) was an extraordinarily sophisticated, stealthy kernel-mode rootkit and spam botnet active between 2006 ...
ghost	Rat	`1`	Gh0st RAT (also tracked in security taxonomies as GhostRAT or Backdoor.Gh0st) is a seminal open-source Remote Access Trojan originally authored in 2008 by the C...

Attributed Threat Actors & Syndicates

Threat intelligence confirms the following adversaries weaponize CVE-2006-0003 in enterprise intrusions and campaign toolkits:

Chinese APT Syndicates — Attributed Threat Group / Campaign Operator
Dmitrij Nechvolod (Cosma) — Attributed Threat Group / Campaign Operator
Huang Xin — Attributed Threat Group / Campaign Operator
Russian Business Network (RBN) — Attributed Threat Group / Campaign Operator
Sinowal Syndicate — Attributed Threat Group / Campaign Operator

SOC Detection & Threat Hunting Guidance

Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2006-0003 in enterprise networks:

Sysmon Event ID 1: wmplayer.exe launching command interpreters (cmd.exe, powershell.exe) or dropping PE binaries into %APPDATA% or %TEMP%.

Remediation & Defensive Hardening

SOC containment checklist and attack surface reduction measures to neutralize exploitation:

Actionable Guidance: Apply MS06-005 patch; restrict browser launch permissions for legacy ActiveX controls; deploy modern content security policies.

For end-to-end incident response procedures, consult our dedicated playbook: Backdoor & RAT Protection for Businesses →

← Return to Vulnerability Matrix Directory (All 63 CVEs)