cbcvebase.
CVE-2007-0612
published 2007-01-31

CVE-2007-0612: Multiple ActiveX controls in Microsoft Windows 2000, XP, 2003, and Vista allows remote attackers to cause a denial of service (Internet Explorer crash) by…

PriorityP336high7.8CVSS 2.0
AVNACLAuNCNINAC
EXPLOIT
EPSS
42.88%
98.6th percentile
Multiple ActiveX controls in Microsoft Windows 2000, XP, 2003, and Vista allows remote attackers to cause a denial of service (Internet Explorer crash) by accessing the bgColor, fgColor, linkColor, alinkColor, vlinkColor, or defaultCharset properties in the (1) giffile, (2) htmlfile, (3) jpegfile, (4) mhtmlfile, (5) ODCfile, (6) pjpegfile, (7) pngfile, (8) xbmfile, (9) xmlfile, (10) xslfile, or (11) wdfile objects in (a) mshtml.dll; or the (12) TriEditDocument.TriEditDocument or (13) TriEditDocument.TriEditDocument.1 objects in (b) triedit.dll, which cause a NULL pointer dereference.

Affected

7 ranges
VendorProductVersion rangeFixed in
microsoftie——
microsoftie——
microsoftie——
microsoftinternet_explorer——
microsoftinternet_explorer——
microsoftinternet_explorer——
microsoftinternet_explorer——

Detection & IOCsextracted from sources · hover to see the quote

commandnew ActiveXObject("giffile")↗
  • →Detect instantiation of any of the vulnerable ActiveX ProgIDs (giffile, htmlfile, jpegfile, mhtmlfile, ODCfile, pjpegfile, pngfile, xbmfile, xmlfile, xslfile, wdfile, TriEditDocument.TriEditDocument, TriEditDocument.TriEditDocument.1) followed by access to color/charset properties (bgColor, fgColor, linkColor, alinkColor, vlinkColor, defaultCharset) — this pattern triggers a NULL pointer dereference crash in mshtml.dll or triedit.dll ↗
  • →Attack vector is drive-by: victim must visit a malicious website. Monitor for IE process crashes (null dereference in mshtml.dll or triedit.dll) shortly after web navigation as a host-based indicator. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.