cbcvebase.
CVE-2007-0031
published 2007-01-09

CVE-2007-0031: Heap-based buffer overflow in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2004 for Mac, and v.X for Mac allows user-assisted remote attackers to execute…

PriorityP355critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
41.69%
98.5th percentile
Heap-based buffer overflow in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2004 for Mac, and v.X for Mac allows user-assisted remote attackers to execute arbitrary code via a BIFF8 spreadsheet with a PALETTE record that contains a large number of entries.

Affected

11 ranges
VendorProductVersion rangeFixed in
microsoftexcel——
microsoftexcel——
microsoftexcel——
microsoftexcel_viewer——
microsoftoffice——
microsoftoffice——
microsoftoffice——
microsoftoffice——
microsoftoffice——
microsoftworks——
microsoftworks——

Detection & IOCsextracted from sources · hover to see the quote

bytes↗
PALETTE record: 0x0092 0x00E2 0x01FF (malformed, count=0x01FF)
  • →Detect BIFF8 XLS files containing a PALETTE record (record type 0x0092) with an entry count field (third word) exceeding the legitimate maximum of 0x0038 (56 entries). A count of 0x01FF or similarly inflated value indicates exploitation of CVE-2007-0031. ↗
  • →The exploit patches a legitimate BIFF8 spreadsheet by replacing the normal PALETTE record header bytes (92 00 E2 00 38 00) with a malformed one (92 00 E2 00 FF 01). Scan XLS files at rest or in transit for this specific byte pattern. ↗
  • →The PoC generates a malicious file named 'after.xls'. Monitor for suspicious XLS files with this name delivered via email or web, especially alongside a benign 'before.xls' staging file. ↗
  • →The vulnerability is triggered specifically in BIFF8 format spreadsheets via the PALETTE record. Inspect compound document (OLE2) XLS files for PALETTE records where the declared entry count multiplied by 4 bytes exceeds the actual record data length. ↗
  • ·The PoC only achieves a Denial of Service in the general case. Arbitrary code execution requires a specific heap state (e.g., another Excel file already open), making reliable exploitation environment-dependent. ↗
  • ·The heap overflow overwrites only 2 bytes and only within a restricted address range, not arbitrary memory, limiting the exploitability compared to a fully arbitrary write primitive. ↗
  • ·The exploit requires modification of the pyExcelerator library to generate a PALETTE record; stock pyExcelerator 0.6.3a does not produce one, so the PoC toolchain is non-standard. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.