CVE-2007-0038
Stack-based buffer overflow in the animated cursor code in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code or...
- Published
- Mar 30, 2007
- Updated
- Aug 7, 2024
- Assigning CNA
- microsoft
- Evidence observed
- Mar 31, 2007
Primary CVSS
nvd · CVSS 2.0
AV:N/AC:M/Au:N/C:C/I:C/A:CHigh · next 30 days
- Percentile
- 99.4%
- Model date
- Sep 21, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
Stack-based buffer overflow in the animated cursor code in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code or cause a denial of service (persistent reboot) via a large length value in the second (or later) anih block of a RIFF .ANI, cur, or .ico file, which results in memory corruption when processing cursors, animated cursors, and icons, a variant of CVE-2005-0416, as originally demonstrated using Internet Explorer 6 and 7. NOTE: this might be a duplicate of CVE-2007-1765; if so, then CVE-2007-0038 should be preferred.
Sources
16- CVE-2007-0038Exploit
IE7 buffer overflow through an ANI file
devcode · windows · Mar 31, 2007
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.