CVE-2007-4916

HighPublished

Heap-based buffer overflow in the FileFind::FindFile method in (1) MFC42.dll, (2) MFC42u.dll, (3) MFC71.dll, and (4) MFC71u.dll in Microsoft Foundation...

Published: Sep 17, 2007
Updated: Aug 7, 2024
Assigning CNA: mitre
Evidence observed: Sep 14, 2007

Primary CVSS

10.0/ 10High

nvd · CVSS 2.0

AV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS probability estimate

19.7%

Moderate · next 30 days

Percentile: 97.3%
Model date: Oct 13, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

Heap-based buffer overflow in the FileFind::FindFile method in (1) MFC42.dll, (2) MFC42u.dll, (3) MFC71.dll, and (4) MFC71u.dll in Microsoft Foundation Class (MFC) Library 8.0, as used by the ListFiles method in hpqutil.dll 2.0.0.138 in Hewlett-Packard (HP) All-in-One and Photo & Imaging Gallery 1.1 and probably other products, allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long first argument.

Sources

HP - ActiveX 'hpqutil.dll' ListFiles Remote Heap Overflow (PoC)Exploit
GOODFELLAS · windows · Sep 14, 2007
Microsoft MFC Library - CFileFind::FindFile Buffer OverflowExploit
Jonathan Sarba · windows · Sep 14, 2007

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.