CVE-2007-0671

microsoft access, microsoft excel, microsoft excel viewer

Published 3 Feb 2007 · updated 16 Jun 2026 · Analyzed

8.8 High · CVSS 3.1, CISA ADP

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 12 Aug 2025, with a remediation deadline of 2 Sept 2025 for US federal agencies.

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Description

Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Office products, allows remote user-assisted attackers to execute arbitrary code via unknown attack vectors, as demonstrated by Exploit-MSExcel.h in targeted zero-day attacks.

References

osvdb.org/31901 · Broken Link
secunia.com/advisories/24008 · Broken Link, Vendor Advisory
securitytracker.com/id?1017584 · Broken Link
vil.nai.com/vil/content/v_141393.htm · Broken Link
www.avertlabs.com/research/blog/?p=191 · Broken Link
www.kb.cert.org/vuls/id/613740 · US Government Resource
www.microsoft.com/technet/security/advisory/932553.mspx · Broken Link, Vendor Advisory
www.securityfocus.com/bid/22383 · Broken Link
www.us-cert.gov/cas/techalerts/TA07-044A.html · Broken Link, US Government Resource
www.vupen.com/english/advisories/2007/0463 · Vendor Advisory
docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-015 · Vendor Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/32178 · Third Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A301 · Broken Link
learn.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-015 · Vendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2007-0671 · US Government Resource