diff --git a/dlls/msxml3/tests/saxreader.c b/dlls/msxml3/tests/saxreader.c
index 06fd56a21e2..da662bb9249 100644
--- a/dlls/msxml3/tests/saxreader.c
+++ b/dlls/msxml3/tests/saxreader.c
@@ -168,9 +168,11 @@ typedef enum _CH {
     CH_IGNORABLEWHITESPACE,
     CH_PROCESSINGINSTRUCTION,
     CH_SKIPPEDENTITY,
+    LH_STARTCDATA,
+    LH_ENDCDATA,
     EH_ERROR,
     EH_FATALERROR,
-    EG_IGNORABLEWARNING,
+    EH_IGNORABLEWARNING,
     EVENT_LAST
 } CH;
 
@@ -187,6 +189,8 @@ static const char *event_names[EVENT_LAST] = {
     "ignorableWhitespace",
     "processingInstruction",
     "skippedEntity",
+    "startCDATA",
+    "endCDATA",
     "error",
     "fatalError",
     "ignorableWarning"
@@ -410,6 +414,8 @@ static void ok_sequence_(struct call_sequence **seq, int sequence_index,
             case CH_PUTDOCUMENTLOCATOR:
             case CH_STARTDOCUMENT:
             case CH_ENDDOCUMENT:
+            case LH_STARTCDATA:
+            case LH_ENDCDATA:
                 break;
             case CH_STARTPREFIXMAPPING:
                 /* prefix, uri */
@@ -459,7 +465,7 @@ static void ok_sequence_(struct call_sequence **seq, int sequence_index,
                          context, get_event_name(actual->id), expected->ret, actual->ret);
                 break;
             case EH_ERROR:
-            case EG_IGNORABLEWARNING:
+            case EH_IGNORABLEWARNING:
             default:
                 ok(0, "%s: callback not handled, %s\n", context, get_event_name(actual->id));
             }
@@ -570,6 +576,10 @@ static const char test_attributes[] =
 "<node1 xmlns:p=\"test\" />"
 "</document>\n";
 
+static const char test_cdata_xml[] =
+"<?xml version=\"1.0\" ?>"
+"<a><![CDATA[Some \r\ntext\n\rdata\n]]></a>";
+
 static struct call_entry content_handler_test1[] = {
     { CH_PUTDOCUMENTLOCATOR, 0, 0, S_OK },
     { CH_STARTDOCUMENT, 0, 0, S_OK },
@@ -894,6 +904,37 @@ static struct call_entry attribute_norm_alt[] = {
     { CH_ENDTEST }
 };
 
+static struct call_entry cdata_test[] = {
+    { CH_PUTDOCUMENTLOCATOR, 0, 0, S_OK },
+    { CH_STARTDOCUMENT, 0, 0, S_OK },
+    { CH_STARTELEMENT, 1, 26, S_OK, "", "a", "a" },
+    { LH_STARTCDATA, 1, 35, S_OK },
+    { CH_CHARACTERS, 1, 35, S_OK, "Some \n" },
+    { CH_CHARACTERS, 1, 42, S_OK, "text\n\n" },
+    { CH_CHARACTERS, 4, 1, S_OK,  "data\n" },
+    { LH_ENDCDATA, 4, 1, S_OK },
+    { CH_ENDELEMENT, 4, 6, S_OK, "", "a", "a" },
+    { CH_ENDDOCUMENT, 0, 0, S_OK },
+    { CH_ENDTEST }
+};
+
+/* this is what MSXML6 does */
+static struct call_entry cdata_test_alt[] = {
+    { CH_PUTDOCUMENTLOCATOR, 1, 0, S_OK },
+    { CH_STARTDOCUMENT, 1, 22, S_OK },
+    { CH_STARTELEMENT, 1, 25, S_OK, "", "a", "a" },
+    { LH_STARTCDATA, 1, 34, S_OK },
+    { CH_CHARACTERS, 1, 40, S_OK, "Some " },
+    { CH_CHARACTERS, 2, 0, S_OK, "\n" },
+    { CH_CHARACTERS, 3, 1, S_OK, "text\n" },
+    { CH_CHARACTERS, 4, 0, S_OK, "\n" },
+    { CH_CHARACTERS, 5, 3, S_OK, "data\n" },
+    { LH_ENDCDATA, 5, 3, S_OK },
+    { CH_ENDELEMENT, 5, 7, S_OK, "", "a", "a" },
+    { CH_ENDDOCUMENT, 5, 7, S_OK },
+    { CH_ENDTEST }
+};
+
 static const char xmlspace_attr[] =
     "<?xml version=\"1.0\" encoding=\"UTF-16\"?>"
     "<a xml:space=\"preserve\"> Some text data </a>";
@@ -1275,7 +1316,7 @@ static HRESULT WINAPI isaxerrorHandler_fatalError(
     return S_OK;
 }
 
-static HRESULT WINAPI isaxerrorHanddler_ignorableWarning(
+static HRESULT WINAPI isaxerrorHandler_ignorableWarning(
         ISAXErrorHandler* iface,
         ISAXLocator *pLocator,
         const WCHAR *pErrorMessage,
@@ -1292,7 +1333,7 @@ static const ISAXErrorHandlerVtbl errorHandlerVtbl =
     isaxerrorHandler_Release,
     isaxerrorHandler_error,
     isaxerrorHandler_fatalError,
-    isaxerrorHanddler_ignorableWarning
+    isaxerrorHandler_ignorableWarning
 };
 
 static ISAXErrorHandler errorHandler = { &errorHandlerVtbl };
@@ -1583,14 +1624,24 @@ static HRESULT WINAPI isaxlexical_endEntity(ISAXLexicalHandler *iface,
 
 static HRESULT WINAPI isaxlexical_startCDATA(ISAXLexicalHandler *iface)
 {
-    ok(0, "call not expected\n");
-    return E_NOTIMPL;
+    struct call_entry call;
+
+    init_call_entry(locator, &call);
+    call.id = LH_STARTCDATA;
+    add_call(sequences, CONTENT_HANDLER_INDEX, &call);
+
+    return get_expected_ret();
 }
 
 static HRESULT WINAPI isaxlexical_endCDATA(ISAXLexicalHandler *iface)
 {
-    ok(0, "call not expected\n");
-    return E_NOTIMPL;
+    struct call_entry call;
+
+    init_call_entry(locator, &call);
+    call.id = LH_ENDCDATA;
+    add_call(sequences, CONTENT_HANDLER_INDEX, &call);
+
+    return get_expected_ret();
 }
 
 static HRESULT WINAPI isaxlexical_comment(ISAXLexicalHandler *iface,
@@ -1880,6 +1931,9 @@ static struct msxmlsupported_data_t reader_support_data[] =
     { NULL }
 };
 
+static struct saxlexicalhandler lexicalhandler;
+static struct saxdeclhandler declhandler;
+
 static void test_saxreader(void)
 {
     const struct msxmlsupported_data_t *table = reader_support_data;
@@ -2230,6 +2284,36 @@ static void test_saxreader(void)
         hr = ISAXXMLReader_putEntityResolver(reader, NULL);
         ok(hr == S_OK || broken(hr == E_FAIL), "got 0x%08x\n", hr);
 
+        /* CDATA sections */
+        CreateStreamOnHGlobal(NULL, TRUE, &stream);
+        size.QuadPart = strlen(test_cdata_xml);
+        IStream_SetSize(stream, size);
+        IStream_Write(stream, test_cdata_xml, strlen(test_cdata_xml), &written);
+        pos.QuadPart = 0;
+        IStream_Seek(stream, pos, STREAM_SEEK_SET, NULL);
+
+        init_saxlexicalhandler(&lexicalhandler, S_OK);
+
+        V_VT(&var) = VT_UNKNOWN;
+        V_UNKNOWN(&var) = (IUnknown*)&lexicalhandler.ISAXLexicalHandler_iface;
+        hr = ISAXXMLReader_putProperty(reader, _bstr_("http://xml.org/sax/properties/lexical-handler"), var);
+        ok(hr == S_OK, "got 0x%08x\n", hr);
+
+        V_VT(&var) = VT_UNKNOWN;
+        V_UNKNOWN(&var) = (IUnknown*)stream;
+
+        if (IsEqualGUID(table->clsid, &CLSID_SAXXMLReader60))
+            test_seq = cdata_test_alt;
+        else
+            test_seq = cdata_test;
+
+        set_expected_seq(test_seq);
+        hr = ISAXXMLReader_parse(reader, var);
+        ok(hr == S_OK, "got 0x%08x\n", hr);
+        ok_sequence(sequences, CONTENT_HANDLER_INDEX, test_seq, "cdata test", TRUE);
+
+        IStream_Release(stream);
+
         ISAXXMLReader_Release(reader);
         table++;
     }
@@ -2243,9 +2327,6 @@ struct saxreader_props_test_t
     IUnknown   *iface;
 };
 
-static struct saxlexicalhandler lexicalhandler;
-static struct saxdeclhandler declhandler;
-
 static const struct saxreader_props_test_t props_test_data[] = {
     { "http://xml.org/sax/properties/lexical-handler", (IUnknown*)&lexicalhandler.ISAXLexicalHandler_iface },
     { "http://xml.org/sax/properties/declaration-handler", (IUnknown*)&declhandler.ISAXDeclHandler_iface },