cbcvebase.
CVE-2007-2223
published 2007-08-14

CVE-2007-2223: Microsoft XML Core Services (MSXML) 3.0 through 6.0 allows remote attackers to execute arbitrary code via the substringData method on a (1) TextNode or (2)…

PriorityP261critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
48.72%
98.9th percentile
Microsoft XML Core Services (MSXML) 3.0 through 6.0 allows remote attackers to execute arbitrary code via the substringData method on a (1) TextNode or (2) XMLDOM object, which causes an integer overflow that leads to a buffer overflow.

Affected

4 ranges
VendorProductVersion rangeFixed in
microsoftxml_core_services——
microsoftxml_core_services——
microsoftxml_core_services——
microsoftxml_core_services——

Detection & IOCsextracted from sources · hover to see the quote

othersubstringData(1,0x7fffffff)↗
  • →Look for JavaScript/VBScript invoking the substringData method on TextNode or XMLDOM ActiveX objects with an extremely large second argument (e.g. 0x7fffffff) — this is the integer overflow trigger for CVE-2007-2223. ↗
  • →Monitor instantiation of Microsoft XMLDOM or Microsoft XML Core Services ActiveX objects (Microsoft.XMLDOM) in browser scripting contexts, particularly when followed by substringData calls. ↗
  • →The exploit vector is drive-by: users are lured to malicious web content that issues crafted substringData requests to MSXML, resulting in heap memory corruption. ↗
  • ·Affected versions span MSXML 3.0 through 6.0; the exploit PoC specifically targets MSXML 6.0. Detections should cover all versions in this range. ↗
  • ·The overflow can be triggered via either a TextNode object or an XMLDOM object — detection logic should account for both attack surfaces. ↗
  • ·Failed exploitation degrades to a denial-of-service condition rather than code execution; crash/hang telemetry on MSXML-consuming processes (e.g. Internet Explorer) may indicate attempted exploitation even without full RCE. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.