CVE-2007-5348

published 2008-09-11

CVE-2007-5348: Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, Office XP SP3…

Priority P2 67 critical 9.3 CVSS 2.0

AV N AC M Au N C C I C A C

EXPLOIT

Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, Office XP SP3, Office 2003 SP2 and SP3, 2007 Microsoft Office System Gold and SP1, Visio 2002 SP2, PowerPoint Viewer 2003, Works 8, Digital Image Suite 2006, SQL Server 2000 Reporting Services SP2, SQL Server 2005 SP2, Report Viewer 2005 SP1 and 2008, and Forefront Client Security 1.0 allows remote attackers to execute arbitrary code via an image file with crafted gradient sizes in gradient fill input, which triggers a heap-based buffer overflow related to GdiPlus.dll and VGX.DLL, aka "GDI+ VML Buffer Overrun Vulnerability."

Affected

16 ranges

Vendor	Product	Version range	Fixed in
microsoft	digital_image_suite	—	—
microsoft	forefront_client_security	—	—
microsoft	internet_explorer	—	—
microsoft	office	—	—
microsoft	office	—	—
microsoft	office_powerpoint_viewer	—	—
microsoft	report_viewer	—	—
microsoft	report_viewer	—	—
microsoft	server	—	—
microsoft	sql_server	—	—
microsoft	sql_server_reporting_services	—	—
microsoft	visio	—	—
microsoft	windows	—	—
microsoft	windows-nt	—	—
microsoft	windows-nt	—	—
microsoft	works	—	—

Detection & IOCs extracted from sources · hover to see the quote

filename GdiPlus.dll↗

filename VGX.DLL↗

version Gdiplus.dll 5.1.3102.2180↗

version Internet Explorer 6.0.2900.2180↗

• → VML namespace behavior URL binding (url(#default#VML)) in CSS is used to activate the vulnerable VML rendering path; monitor HTML/CSS content using this pattern ↗
• → Vulnerability is triggered via a crafted image file with malicious gradient fill input (crafted gradient sizes), resulting in a heap-based buffer overflow in GDI+ ↗

• · PoC targets specifically Windows XP SP2 with IE 6.0.2900.2180; exploit behavior and reliability may differ across the broader affected product list (Vista, Server 2003/2008, Office, etc.) ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-189