CVE-2007-0671
Microsoft Office Excel contains a remote code execution vulnerability that can be exploited when a specially crafted Excel file is opened. This malicious file could be delivered as an email attachment or hosted on a malicious website. An attacker could leverage this vulnerability by creating a specially crafted Excel file, which, when opened, allowing an attacker to execute remote code on the affected system.
Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Office products, allows remote user-assisted attackers to execute arbitrary code via unknown attack vectors, as demonstrated by Exploit-MSExcel.h in targeted zero-day attacks.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H- osvdb.org/31901Broken Link
- secunia.com/advisories/24008Broken LinkVendor Advisory
- securitytracker.com/id?1017584Broken Link
- vil.nai.com/vil/content/v_141393.htmBroken Link
- avertlabs.com/research/blog/?p=191Broken Link
- kb.cert.org/vuls/id/613740US Government Resource
- microsoft.com/technet/security/advisory/932553.mspxBroken LinkVendor Advisory
- securityfocus.com/bid/22383Broken Link
- us-cert.gov/cas/techalerts/TA07-044A.htmlBroken LinkUS Government Resource
- vupen.com/english/advisories/2007/0463Vendor Advisory
- docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-015Vendor Advisory
- exchange.xforce.ibmcloud.com/vulnerabilities/32178Third Party Advisory
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 420 days
- CVSS
- 8.8 HIGH
- EPSS (30-day exploit probability)
- 43.2% · top 1% of all CVEs
- Weakness
- NVD-CWE-noinfo
- Attack vector
- Network, remotely reachable
- 1.Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.