CVE-2007-0025

CWE-94 — Code Injection3 documents3 sources
Severity
9.3CRITICAL
EPSS
73.9%
top 1.18%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Microsoft Visual Studio .netMicrosoft Windows 2003 Server
Timeline
PublishedFeb 13
Latest updateMay 1

Description

The MFC component in Microsoft Windows 2000 SP4, XP SP2, and 2003 SP1 and Visual Studio .NET 2000, 2002 SP1, 2003, and 2003 SP1 allows user-assisted remote attackers to execute arbitrary code via an RTF file with a malformed OLE object that triggers memory corruption. NOTE: this might be due to a stack-based buffer overflow in the AfxOleSetEditMenu function in MFC42u.dll.

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages2 packages

▶NVDmicrosoft/windows_2003_server2000, 2003, xp_sp2+2

🔴Vulnerability Details

2
GHSA
GHSA-gh84-chcq-ggcf: The MFC component in Microsoft Windows 2000 SP4, XP SP2, and 2003 SP1 and Visual Studio↗2022-05-01
▶
CVEList
CVE-2007-0025: The MFC component in Microsoft Windows 2000 SP4, XP SP2, and 2003 SP1 and Visual Studio↗2007-02-13
▶
CVE-2007-0025 (CRITICAL CVSS 9.3) | The MFC component in Microsoft Wind | cvebase.io