CVE-2007-2224
Object linking and embedding (OLE) Automation, as used in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Office 2004 for Mac, and Visual Basic 6.0 allows remote attackers to execute arbitrary code via the substringData method on a TextNode object, which causes an integer overflow that leads to a buffer overflow.
Key facts
- CVSS score
- 9.3 (v2.0)
- Severity
- HIGH
- CVSS vector
AV:N/AC:M/Au:N/C:C/I:C/A:C- Weakness (CWE)
- CWE-119
- EPSS score
- 34.5% (98th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2007-2219)
- Published
- August 14, 2007
- NVD last modified
- June 16, 2026
- Status
- Modified
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2007-2219 in the EU Vulnerability Database. Last updated in EUVD on August 7, 2024.
View on the EU Vulnerability DatabaseAffected products
- microsoft / office
- microsoft / visual basic
- microsoft / windows 2000
- microsoft / windows 2003 server
- microsoft / windows 2003 server
- microsoft / windows xp
Certified products that may be affected
4 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.
- Windows XP Enhanced Cryptographic Provider (RSAENH) - Microsoft Corporation - FIPS 140 989 - historical
- Windows XP Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) - Microsoft Corporation - FIPS 140 990 - historical
- Microsoft Windows Server 2003 SP2 including R2, Standard, Enterprise, Datacenter, x64, and Itanium Editions; Windows XP Professional SP2 and x64 SP2; Windows XP Embedded SP2 - Microsoft Corporation - Common Criteria CCEVS-VR-VID-10184-2008 - archived
- Microsoft Windows 2003 and Microsoft Windows XP - Microsoft Corporation - Common Criteria CCEVS-VR-0131-2005 - archived
References
- http://secunia.com/advisories/26449(Vendor Advisory)
- http://www.securityfocus.com/archive/1/476527/100/0/threaded
- http://www.securityfocus.com/bid/25282
- http://www.securitytracker.com/id?1018560
- http://www.us-cert.gov/cas/techalerts/TA07-226A.html(US Government Resource)
- http://www.vupen.com/english/advisories/2007/2867(Vendor Advisory)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-043
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1248
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain