Read the docs
TI-2006-00352 Aliases CVE-2006-0363GHSA-7x7q-g489-cq27

The "Remember my Password" feature in MSN Messenger 7.5 stores passwords in an encrypted…

Priority LOW 16Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · None · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

The "Remember my Password" feature in MSN Messenger 7.5 stores passwords in an encrypted format under the HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Creds registry key, which might allow local users to obtain the original passwords via a program that calls CryptUnprotectData, as demonstrated by the "MSN Password Recovery.exe" program. NOTE: it could be argued that local-only password recovery is inherently insecure because the decryption methods and keys must be stored somewhere on the local system, and are thus inherently accessible with varying degrees of effort. Perhaps this issue should not be included in CVE.

Why it matters now

EPSS 0.02642 85th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:msn_messenger:7.5:*:*:*:*:*:*:*7.5VulnerableMicrosoft
  • cpe:2.3:a:microsoft:msn_messenger:7.5:*:*:*:*:*:*:* Versions 7.5 Vulnerable ·Microsoft

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2006-0363
  2. 2026-10-03 Alias added: GHSA-7x7q-g489-cq27

References

Other 1

  • TI-2004-00538 Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products… CVSS 2.0HIGH 10.0
  • TI-2007-02837 Heap-based buffer overflow in Microsoft MSN Messenger 6.2, 7.0, and 7.5, and Live… CVSS 2.0HIGH 9.3
  • TI-2002-00151 Buffer overflow in Microsoft MSN Chat ActiveX Control, as used in MSN Messenger 4.5 and… CVSS 2.0HIGH 7.5
  • TI-2005-00513 GIF file validation error in MSN Messenger 6.2 allows remote attackers in a user's… CVSS 2.0HIGH 7.5
  • TI-2004-00105 Microsoft MSN Messenger 6.0 and 6.1 does not properly handle certain requests, which… CVSS 2.0MEDIUM 5.0
  • TI-2002-01750 Microsoft MSN Messenger Service 1.0 through 4.6 allows remote attackers to cause a denial… CVSS 2.0MEDIUM 5.0
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences