Heap-based buffer overflow in the IMA_SECURE_DecryptData1 function in ImaSystem.dll for…
Priority MEDIUM 41Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
Heap-based buffer overflow in the IMA_SECURE_DecryptData1 function in ImaSystem.dll for Citrix MetaFrame XP 1.0 and 2.0, and Presentation Server 3.0 and 4.0, allows remote attackers to execute arbitrary code via requests to the Independent Management Architecture (IMA) service (ImaSrv.exe) with invalid size values that trigger the overflow during decryption.
Why it matters now
EPSS 0.05201 92nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:citrix:metaframe:1.0:*:windows_2000:*:*:*:*:* | 1.0 | Vulnerable | Citrix |
| cpe:2.3:a:citrix:metaframe:3.0:*:microsoft_windows_2000:*:*:*:*:* | 3.0 | Vulnerable | Citrix |
| cpe:2.3:a:citrix:metaframe_presentation_server:4.0:*:64-bit:*:*:*:*:* | 4.0 | Vulnerable | Citrix |
| cpe:2.3:a:citrix:metaframe_presentation_server:4.0:*:microsoft_windows_2000:*:*:*:*:* | 4.0 | Vulnerable | Citrix |
| cpe:2.3:a:citrix:metaframe_presentation_server:4.0:*:microsoft_windows_2003:*:*:*:*:* | 4.0 | Vulnerable | Citrix |
- cpe:2.3:a:citrix:metaframe:1.0:*:windows_2000:*:*:*:*:* Versions 1.0 Vulnerable ·Citrix
- cpe:2.3:a:citrix:metaframe:3.0:*:microsoft_windows_2000:*:*:*:*:* Versions 3.0 Vulnerable ·Citrix
- cpe:2.3:a:citrix:metaframe_presentation_server:4.0:*:64-bit:*:*:*:*:* Versions 4.0 Vulnerable ·Citrix
- cpe:2.3:a:citrix:metaframe_presentation_server:4.0:*:microsoft_windows_2000:*:*:*:*:* Versions 4.0 Vulnerable ·Citrix
- cpe:2.3:a:citrix:metaframe_presentation_server:4.0:*:microsoft_windows_2003:*:*:*:*:* Versions 4.0 Vulnerable ·Citrix
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2006-5821
- 2026-10-03 Alias added: GHSA-qqw2-f4rr-7m6p
References
More Citrix Metaframe vulnerabilities
- TI-2007-02757 The Session Reliability Service (XTE) in Citrix MetaFrame Presentation Server 3.0… CVSS 2.0HIGH 10.0
- TI-2007-00431 Stack-based buffer overflow in the print provider library (cpprov.dll) in Citrix… CVSS 2.0HIGH 7.2
- TI-2000-00244 The Citrix ICA (Independent Computing Architecture) protocol uses weak encryption (XOR) for user authentication. CVSS 2.0HIGH 10.0
- TI-2005-02962 Citrix Metaframe Presentation Server 3.0 and 4.0 allows remote attackers to bypass policy… CVSS 2.0HIGH 7.5
- TI-2001-00865 CITRIX Metaframe 1.8 logs the Client Address (IP address) that is provided by the client… CVSS 2.0HIGH 7.5
- TI-2006-03666 Citrix MetaFrame up to XP 1.0 Feature 1, except when running on Windows Server 2003… CVSS 2.0MEDIUM 6.5
Sources
- CVE-2006-5821 · CVE Program
- CVE-2006-5821 · NVD
- FIRST EPSS
- GHSA-qqw2-f4rr-7m6p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences