CVE-2007-0038

Exp

Stack-based buffer overflow in the animated cursor code in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code or cause a denial of service (persistent reboot) via a large length value in the second (or later) anih block of a RIFF .ANI, cur, or .ico file, which results in memory corruption when processing cursors, animated cursors, and icons, a variant of CVE-2005-0416, as originally demonstrated using Internet Explorer 6 and 7. NOTE: this might be a duplicate of CVE-2007-1765; if so, then CVE-2007-0038 should be preferred.

Published: 2007-03-30 Last update: 2026-04-23 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2007-0038 is rated High Exploit Risk (87.1/100): CVSS Critical severity, with high exploitation likelihood (EPSS 88.04%, 99th percentile). 15 public exploit reference(s) are indexed (Exploit-DB). Public exploits are available—assess exposure, apply mitigations, and prioritize patching.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Public exploit references (Exploit-DB) for CVE-2007-0038

EDB-ID Source Kind Published Link
16698 exploit_db edb 2010-09-20 Exploit-DB ↗
16526 exploit_db edb 2010-08-12 Exploit-DB ↗
4045 exploit_db edb 2007-06-07 Exploit-DB ↗
3804 exploit_db edb 2007-04-26 Exploit-DB ↗
3755 exploit_db edb 2007-04-17 Exploit-DB ↗
3695 exploit_db edb 2007-04-09 Exploit-DB ↗
3688 exploit_db edb 2007-04-08 Exploit-DB ↗
3684 exploit_db edb 2007-04-08 Exploit-DB ↗
3651 exploit_db edb 2007-04-03 Exploit-DB ↗
3652 exploit_db edb 2007-04-03 Exploit-DB ↗
3647 exploit_db edb 2007-04-02 Exploit-DB ↗
3634 exploit_db edb 2007-04-01 Exploit-DB ↗
3635 exploit_db edb 2007-04-01 Exploit-DB ↗
3636 exploit_db edb 2007-04-01 Exploit-DB ↗
3617 exploit_db edb 2007-03-31 Exploit-DB ↗

Exploit prediction scoring system (EPSS) score for CVE-2007-0038

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-03-02 87.92% 88.04% +0.13%
2 2026-01-08 86.83% 87.92% +1.09%
3 2025-11-16 — 86.83% —

Full EPSS history (24 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2007-0038

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
9.3 2.0 HIGH
AV:N/AC:M/Au:N/C:C/I:C/A:C Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:M)
Exploitation needs some favorable conditions, but not exceptional ones.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:C)
Complete confidentiality impact.
Integrity impact (I:C)
Complete integrity impact.
Availability impact (A:C)
Complete availability impact.
 8.6 10.0 [email protected]

Weakness enumeration for CVE-2007-0038

Affected software / configurations for CVE-2007-0038

Vendor Product Version Raw CPE
microsoft windows_2000 — cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*
microsoft windows_2003_server gold cpe:2.3:o:microsoft:windows_2003_server:gold:*:*:*:*:*:*:*
microsoft windows_2003_server gold cpe:2.3:o:microsoft:windows_2003_server:gold:*:itanium:*:*:*:*:*
microsoft windows_2003_server gold cpe:2.3:o:microsoft:windows_2003_server:gold:*:x64:*:*:*:*:*
microsoft windows_2003_server sp1 cpe:2.3:o:microsoft:windows_2003_server:sp1:*:*:*:*:*:*:*
microsoft windows_2003_server sp1 cpe:2.3:o:microsoft:windows_2003_server:sp1:*:itanium:*:*:*:*:*
microsoft windows_2003_server sp2 cpe:2.3:o:microsoft:windows_2003_server:sp2:*:*:*:*:*:*:*
microsoft windows_2003_server sp2 cpe:2.3:o:microsoft:windows_2003_server:sp2:*:itanium:*:*:*:*:*
microsoft windows_2003_server sp2 cpe:2.3:o:microsoft:windows_2003_server:sp2:*:x64:*:*:*:*:*
microsoft windows_vista — cpe:2.3:o:microsoft:windows_vista:*:gold:*:*:*:*:*:*
microsoft windows_vista — cpe:2.3:o:microsoft:windows_vista:*:gold:x64:*:*:*:*:*
microsoft windows_xp — cpe:2.3:o:microsoft:windows_xp:*:gold:professional_x64:*:*:*:*:*
microsoft windows_xp — cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*
microsoft windows_xp — cpe:2.3:o:microsoft:windows_xp:*:sp2:professional_x64:*:*:*:*:*

References for CVE-2007-0038

URL Tags
http://archives.neohapsis.com/archives/fulldisclosure/2007-03/0470.html
http://secunia.com/advisories/24659 Vendor Advisory
http://securityreason.com/securityalert/2542
http://www.determina.com/security_center/security_advisories/securityadvisory_0day_032907.asp Vendor Advisory
http://www.kb.cert.org/vuls/id/191609 US Government Resource
http://www.osvdb.org/33629
http://www.securityfocus.com/archive/1/464269/100/0/threaded
http://www.securityfocus.com/archive/1/464339/100/0/threaded
http://www.securityfocus.com/archive/1/464340/100/0/threaded
http://www.securityfocus.com/archive/1/464342/100/0/threaded
http://www.securityfocus.com/archive/1/464459/100/100/threaded
http://www.securityfocus.com/archive/1/464460/100/100/threaded
http://www.securityfocus.com/archive/1/466186/100/200/threaded
http://www.us-cert.gov/cas/techalerts/TA07-089A.html US Government Resource
http://www.us-cert.gov/cas/techalerts/TA07-093A.html US Government Resource
http://www.us-cert.gov/cas/techalerts/TA07-100A.html US Government Resource
http://www.vupen.com/english/advisories/2007/1215 Vendor Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-017
https://exchange.xforce.ibmcloud.com/vulnerabilities/33301
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1854
cvelogic Threat Intelligence