CVE-2007-3675 json
Multiple format string vulnerabilities in the kavwebscan.CKAVWebScan ActiveX control (kavwebscan.dll) in Kaspersky Online Scanner before 5.…
published 2007-10-12 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-3659
- cvss
- 9.3
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 4.8%
- EPSS 4.8% chance of exploitation in 30 days, percentile 92%
- public exploits
- 0
- none known
Summary
Multiple format string vulnerabilities in the kavwebscan.CKAVWebScan ActiveX control (kavwebscan.dll) in Kaspersky Online Scanner before 5.0.98 allow remote attackers to execute arbitrary code via format string specifiers in "various string formatting functions," which trigger heap-based buffer overflows.
Patch / fix
- kaspersky.com/news?id=207575572 patch
- securitytracker.com/id?1018800 patch
- securityfocus.com/bid/26004 patch
- secunia.com/advisories/27187 advisory
Exploit prediction
4.81% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-134 Use of Externally-Controlled Format String
References
-
kaspersky.com
/news?id=207575572
patch
-
securitytracker.com
/id?1018800
vdb-entry, patch
-
secunia.com
/advisories/27187
third-party-advisory, patch, vendor-advisory
-
securityfocus.com
/bid/26004
vdb-entry, patch
-
exchange.xforce.ibmcloud.com
/vulnerabilities/37057
vdb-entry
-
labs.idefense.com
/intelligence/vulnerabilities/display.php?id=606
third-party-advisory
-
vupen.com
/english/advisories/2007/3455
vdb-entry
Sources
- CVE List CVE-2007-3675
- NVD CVE-2007-3675
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.