CVE-2007-0024

Integer overflow in the Vector Markup Language (VML) implementation (vgx.dll) in Microsoft Internet Explorer 5.01, 6, and 7 on Windows 2000 SP4, XP SP2, Server 2003, and Server 2003 SP1 allows remote attackers to execute arbitrary code via a crafted web page that contains unspecified integer properties that cause insufficient memory allocation and trigger a buffer overflow, aka the "VML Buffer Overrun Vulnerability."

CVSS v2.0

9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS

43.95% chance of exploitation in the next 30 days, 99th percentile

Published

2007-01-09

Updated

2024-08-07

Proof-of-concept exploits (2)

• http://www.securityfocus.com/archive/1/457053/100/0/threaded
• http://www.securityfocus.com/archive/1/457164/100/0/threaded

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/3148
• https://www.exploit-db.com/exploits/3137

References

• CVE Record
• NVD entry

Related

• CVE-2007-0023
• CVE-2007-0031
• CVE-2007-0021
• CVE-2007-0038
• CVE-2007-0020
• CVE-2007-0042