Description
Integer overflow in the AttemptWrite function in Graphics Rendering Engine (GDI) on Microsoft Windows 2000 SP4, XP SP2, and Server 2003 SP1 allows remote attackers to execute arbitrary code via a crafted metafile (image) with a large record length value, which triggers a heap-based buffer overflow.
Metrics
CVSS 2.0 9.3/10
AV:N/AC:M/Au:N/C:C/I:C/A:CWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
References
- http://secunia.com/advisories/26423Vendor Advisory
- http://www.kb.cert.org/vuls/id/640136US Government Resource
- http://www.securityfocus.com/archive/1/476505/100/0/threaded
- http://www.securityfocus.com/bid/25302Patch
- http://www.securitytracker.com/id?1018563
- http://www.us-cert.gov/cas/techalerts/TA07-226A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2007/2870Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-046
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2088
- http://secunia.com/advisories/26423Vendor Advisory
- http://www.kb.cert.org/vuls/id/640136US Government Resource
- http://www.securityfocus.com/archive/1/476505/100/0/threaded
- http://www.securityfocus.com/bid/25302Patch
- http://www.securitytracker.com/id?1018563
- http://www.us-cert.gov/cas/techalerts/TA07-226A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2007/2870Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-046
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2088
Timeline
- Published
- Aug 14, 2007
- Last modified
- Jun 16, 2026
- NVD status
- Modified