CVE-2007-0038: Buffer Overflow
Stack-based buffer overflow in the animated cursor code in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code or cause a denial of service (persistent reboot) via a large length value in the second (or later) anih block of a RIFF .ANI, cur, or .ico file, which results in memory corruption when processing cursors, animated cursors, and icons, a variant of CVE-2005-0416, as originally demonstrated using Internet Explorer 6 and 7. NOTE: this might be a duplicate of CVE-2007-1765; if so, then CVE-2007-0038 should be preferred.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2007-0038?
CVE-2007-0038 is considered critical as it allows remote attackers to execute arbitrary code or cause a denial of service.
How do I fix CVE-2007-0038?
To fix CVE-2007-0038, users should apply the latest security patches provided by Microsoft for their affected Windows version.
What systems are affected by CVE-2007-0038?
CVE-2007-0038 affects Microsoft Windows 2000 SP4 through Windows Vista, including Windows XP and Windows Server 2003.
What kind of attack is associated with CVE-2007-0038?
CVE-2007-0038 is associated with stack-based buffer overflow attacks that exploit specific RIFF image file formats.
Can CVE-2007-0038 lead to a system crash?
Yes, due to the nature of the buffer overflow, CVE-2007-0038 can lead to a system crash or persistent reboot.