CVE-2007-0025 in the critical feed json
The MFC component in Microsoft Windows 2000 SP4, XP SP2, and 2003 SP1 and Visual Studio .NET 2000, 2002 SP1, 2003, and 2003 SP1 allows user…
published 2007-02-13 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-0029
- cvss
- 9.3
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 36.7%
- EPSS 36.7% chance of exploitation in 30 days, percentile 98%
- public exploits
- 0
- none known
Summary
The MFC component in Microsoft Windows 2000 SP4, XP SP2, and 2003 SP1 and Visual Studio .NET 2000, 2002 SP1, 2003, and 2003 SP1 allows user-assisted remote attackers to execute arbitrary code via an RTF file with a malformed OLE object that triggers memory corruption. NOTE: this might be due to a stack-based buffer overflow in the AfxOleSetEditMenu function in MFC42u.dll.
Exploit prediction
36.73% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-94 Improper Control of Generation of Code
References
-
docs.microsoft.com
/en-us/security-updates/securitybulletins/2007/ms07-012
vendor-advisory
-
secunia.com
/advisories/24150
third-party-advisory, vendor-advisory
-
vupen.com
/english/advisories/2007/0581
vdb-entry, vendor-advisory
-
kb.cert.org
/vuls/id/932041
third-party-advisory, us-government-resource
-
securitytracker.com
/id?1017638
vdb-entry
-
osvdb.org
/31887
vdb-entry
-
us-cert.gov
/cas/techalerts/TA07-044A.html
third-party-advisory, us-government-resource
-
securityfocus.com
/bid/22476
vdb-entry
-
oval.cisecurity.org
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A157
vdb-entry, signature
Sources
- CVE List CVE-2007-0025
- NVD CVE-2007-0025
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.