CVE-2007-0215
Status: ModifiedHigh (7.6)—
Stack-based buffer overflow in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, and 2003 Viewer allows user-assisted remote attackers to execute arbitrary code via a .XLS BIFF file with a malformed Named Graph record, which results in memory corruption.
CVSS
- Version: 2.0
- Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C
- Base score: 7.6
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 32%
- Percentile among all scored CVEs: 98
- Score date: 10/7/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (3)
CWEs
- NVD-CWE-Other
References
- http://secunia.com/advisories/25150
- http://www.osvdb.org/34393
- http://www.securityfocus.com/archive/1/467988/100/0/threaded
- http://www.securityfocus.com/archive/1/468871/100/200/threaded
- http://www.securityfocus.com/bid/23760
- http://www.securitytracker.com/id?1018012
- http://www.us-cert.gov/cas/techalerts/TA07-128A.html
- http://www.vupen.com/english/advisories/2007/1708
- http://www.zerodayinitiative.com/advisories/ZDI-07-026.html
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-023
- https://exchange.xforce.ibmcloud.com/vulnerabilities/33913
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1971
- http://secunia.com/advisories/25150
- http://www.osvdb.org/34393
- http://www.securityfocus.com/archive/1/467988/100/0/threaded
- http://www.securityfocus.com/archive/1/468871/100/200/threaded
- http://www.securityfocus.com/bid/23760
- http://www.securitytracker.com/id?1018012
- http://www.us-cert.gov/cas/techalerts/TA07-128A.html
- http://www.vupen.com/english/advisories/2007/1708
- http://www.zerodayinitiative.com/advisories/ZDI-07-026.html
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-023
- https://exchange.xforce.ibmcloud.com/vulnerabilities/33913
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1971
Raw JSON (NVD)
Show
{
"id": "CVE-2007-0215",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 7.6,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
"authentication": "NONE",
"integrityImpact": "COMPLETE",
"accessComplexity": "HIGH",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": false,
"impactScore": 10,
"baseSeverity": "HIGH",
"obtainAllPrivilege": true,
"exploitabilityScore": 4.9,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
]
},
"affected": [
{
"source": "secure@microsoft.com",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2007-05-08T22:19:00.000",
"references": [
{
"url": "http://secunia.com/advisories/25150",
"source": "secure@microsoft.com"
},
{
"url": "http://www.osvdb.org/34393",
"source": "secure@microsoft.com"
},
{
"url": "http://www.securityfocus.com/archive/1/467988/100/0/threaded",
"source": "secure@microsoft.com"
},
{
"url": "http://www.securityfocus.com/archive/1/468871/100/200/threaded",
"source": "secure@microsoft.com"
},
{
"url": "http://www.securityfocus.com/bid/23760",
"source": "secure@microsoft.com"
},
{
"url": "http://www.securitytracker.com/id?1018012",
"source": "secure@microsoft.com"
},
{
"url": "http://www.us-cert.gov/cas/techalerts/TA07-128A.html",
"tags": [
"US Government Resource"
],
"source": "secure@microsoft.com"
},
{
"url": "http://www.vupen.com/english/advisories/2007/1708",
"source": "secure@microsoft.com"
},
{
"url": "http://www.zerodayinitiative.com/advisories/ZDI-07-026.html",
"tags": [
"Patch"
],
"source": "secure@microsoft.com"
},
{
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-023",
"source": "secure@microsoft.com"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33913",
"source": "secure@microsoft.com"
},
{
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1971",
"source": "secure@microsoft.com"
},
{
"url": "http://secunia.com/advisories/25150",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.osvdb.org/34393",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/archive/1/467988/100/0/threaded",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/archive/1/468871/100/200/threaded",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/23760",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securitytracker.com/id?1018012",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.us-cert.gov/cas/techalerts/TA07-128A.html",
"tags": [
"US Government Resource"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.vupen.com/english/advisories/2007/1708",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.zerodayinitiative.com/advisories/ZDI-07-026.html",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-023",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33913",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1971",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Stack-based buffer overflow in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, and 2003 Viewer allows user-assisted remote attackers to execute arbitrary code via a .XLS BIFF file with a malformed Named Graph record, which results in memory corruption."
},
{
"lang": "es",
"value": "Un desbordamiento de búfer en la región stack de la memoria en Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2 y 2003 Viewer permite a los atacantes remotos asistidos por el usuario ejecutar código arbitrario por medio de un archivo BIFF .XLS con un registro de gráfico con nombre inapropiado, lo que resulta en corrupción de memoria."
}
],
"lastModified": "2026-06-16T22:35:08.133",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:excel:2000:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F55D42D5-7371-47C2-BF55-B7F51C19B61E"
},
{
"criteria": "cpe:2.3:a:microsoft:excel:2002:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "082D3262-87E3-4245-AD9C-02BE0871FA3B"
},
{
"criteria": "cpe:2.3:a:microsoft:excel:2003:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5F79E0AB-7081-4F97-BFE4-9AF84F643B9A"
},
{
"criteria": "cpe:2.3:a:microsoft:excel:2007:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5A70D659-F648-4870-852A-4E86D1F4B646"
},
{
"criteria": "cpe:2.3:a:microsoft:excel_viewer:2003:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FDB0020C-A804-4003-B411-1AC7A6E7193E"
},
{
"criteria": "cpe:2.3:a:microsoft:office:2000:sp3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4891122F-AD7F-45E6-98C6-833227916F6B"
},
{
"criteria": "cpe:2.3:a:microsoft:office:2003:sp2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "07D3F3E4-93FB-481A-94D9-075E726697C4"
},
{
"criteria": "cpe:2.3:a:microsoft:office:2004:*:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9409A9BD-1E9B-49B8-884F-8FE569D8AA25"
},
{
"criteria": "cpe:2.3:a:microsoft:office:2007:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "828219FA-E694-46DA-93B0-BE2EC5BBF61E"
},
{
"criteria": "cpe:2.3:a:microsoft:office:xp:sp3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "79BA1175-7F02-4435-AEA6-1BA8AADEB7EF"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "secure@microsoft.com"
}