CVE-2007-0216

published 2008-02-12

CVE-2007-0216: wkcvqd01.dll in Microsoft Works 6 File Converter, as used in Office 2003 SP2, Works 8.0, and Works Suite 2005, allows remote attackers to execute arbitrary…

Priority P3 57 critical 9.3 CVSS 2.0

AV N AC M Au N C C I C A C

EXPLOIT

wkcvqd01.dll in Microsoft Works 6 File Converter, as used in Office 2003 SP2, Works 8.0, and Works Suite 2005, allows remote attackers to execute arbitrary code via a .wps file with crafted section length headers, aka "Microsoft Works File Converter Input Validation Vulnerability."

Affected

3 ranges

Vendor	Product	Version range	Fixed in
microsoft	office	—	—
microsoft	works	—	—
microsoft	works	—	—

Detection & IOCs extracted from sources · hover to see the quote

filename wkcvqd01.dll↗

filename evil.wps↗

bytes↗

43 48 4e 4b 57 4b 53 20

bytes↗

18 00 54 45 58 54 00 00 2f 00 00 00

• → Malicious .wps files will carry the OLE2 compound document magic bytes (D0 CF 11 E0 A1 B1 1A E1) followed by a CHNKWKS stream header. Inspect .wps attachments or downloads for the CHNKWKS marker combined with oversized section length fields. ↗

• · The vulnerability affects multiple product versions: Office 2003 SP2, Works 8.0, and Works Suite 2005 — all sharing the same vulnerable wkcvqd01.dll Works 6 File Converter component. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20