CVE-2007-1090

published 2007-02-26

CVE-2007-1090: Microsoft Windows Explorer on Windows XP and 2003 allows remote user-assisted attackers to cause a denial of service (crash) via a malformed WMF file, which…

Priority P4 24 high 7.1 CVSS 2.0

AV N AC M Au N C N I N A C

EXPLOIT

Microsoft Windows Explorer on Windows XP and 2003 allows remote user-assisted attackers to cause a denial of service (crash) via a malformed WMF file, which triggers the crash when the user browses the folder.

Detection & IOCs extracted from sources · hover to see the quote

filename crash.wmf↗

• → Malicious WMF file triggers crash in Windows Explorer when a user merely browses the containing folder — no file open action required. Monitor for anomalous WMF files dropped in shared/browsable directories. ↗
• → Look for WMF files containing a large NOP sled (repeated 0x90 bytes) within the WMF record payload, which is characteristic of this PoC and potential weaponised variants. ↗

• · This vulnerability affects Windows Explorer on Windows XP and 2003 only; the crash is a denial of service and no code execution has been confirmed for this specific CVE. ↗
• · This issue may be related to two other WMF-based vulnerabilities (BID 19365 and BID 21992); detections should be cross-referenced against those to avoid false-negative gaps. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.