CVE-2007-5095 in the critical feed json
Microsoft Windows Media Player (WMP) 9 on Windows XP SP2 invokes Internet Explorer to render HTML documents contained inside some media fil…
published 2007-09-26 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-5076
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 15.2%
- EPSS 15.2% chance of exploitation in 30 days, percentile 96%
- public exploits
- 0
- none known
Summary
Microsoft Windows Media Player (WMP) 9 on Windows XP SP2 invokes Internet Explorer to render HTML documents contained inside some media files, regardless of what default web browser is configured, which might allow remote attackers to exploit vulnerabilities in software that the user does not expect to run, as demonstrated by the HTMLView parameter in an .asx file.
Exploit prediction
15.17% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
securityfocus.com
/archive/1/479855/100/100/threaded
mailing-list
-
securityfocus.com
/archive/1/479854/100/100/threaded
mailing-list
- gnucitizen.org /blog/backdooring-windows-media-files
-
securityfocus.com
/archive/1/479856/100/100/threaded
mailing-list
-
securityfocus.com
/archive/1/479825/100/100/threaded
mailing-list
-
osvdb.org
/41093
vdb-entry
Sources
- CVE List CVE-2007-5095
- NVD CVE-2007-5095
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.