{"schemaVersion":3,"id":"CVE-2007-0038","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Stack-based buffer overflow in the animated cursor code in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code or cause a denial of service (persistent reboot) via a large length value in the second (or later) anih block of a RIFF .ANI, cur, or .ico file, which results in memory corruption when processing cursors, animated cursors, and icons, a variant of CVE-2005-0416, as originally demonstrated using Internet Explorer 6 and 7. NOTE: this might be a duplicate of CVE-2007-1765; if so, then CVE-2007-0038 should be preferred.","dates":{"published":"2007-03-30T20:00:00.000Z","modified":"2024-08-07T12:03:36.879Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.3,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":9.3,"severity":"high","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.72982,"percentile":0.99452,"severity":"critical","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0.10200000000000209,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.7288},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.7288,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.7288,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.7288,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.7288,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.7288,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.7288,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.7288,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.7288,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.7288,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.7288,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.7288,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.7288,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.7288,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.7288,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.7288,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.7288,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.7288,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.7288,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.72982,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.72982,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.72982,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.72982,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.72982,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.72982,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.72982,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.72982,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.72982,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.72982,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.72982,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.72982,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.72982,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.72982,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.72982,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.72982,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.72982,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.72982,"percentile":0.99452}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.7288,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.7288,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.7288,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.7288,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.7288,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.7288,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.7288,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.7288,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.7288,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.7288,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.7288,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.7288,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.7288,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.72982,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.72982,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.72982,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.72982,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.72982,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.72982,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.72982,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.72982,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.72982,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.72982,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.72982,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.72982,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.72982,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.72982,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.72982,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.72982,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.72982,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.72982,"percentile":0.99452}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"3684","name":"Microsoft Windows Explorer - '.ANI' File Denial of Service","source":"exploit-database","url":"https://www.exploit-db.com/exploits/3684","maturity":"poc","reliabilityScore":0.8,"verified":true,"type":"dos","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"dos","platform":"windows","file":"exploits/windows/dos/3684.c","codes":["CVE-2007-0038","CVE-2007-1765"]},"metasploit":null},{"id":"3647","name":"Microsoft Windows - Animated Cursor '.ani' Local Buffer Overflow","source":"exploit-database","url":"https://www.exploit-db.com/exploits/3647","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"local","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"local","platform":"windows","file":"exploits/windows/local/3647.c","codes":["CVE-2007-0038","CVE-2007-1765"]},"metasploit":null},{"id":"3695","name":"Microsoft Windows - Animated Cursor '.ani' Local Overflow","source":"exploit-database","url":"https://www.exploit-db.com/exploits/3695","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"local","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"local","platform":"windows","file":"exploits/windows/local/3695.c","codes":["CVE-2007-0038","CVE-2007-1765"]},"metasploit":null},{"id":"3652","name":"Microsoft Windows - Animated Cursor '.ani' Local Overflow (Hardware DEP)","source":"exploit-database","url":"https://www.exploit-db.com/exploits/3652","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"local","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"local","platform":"windows","file":"exploits/windows/local/3652.c","codes":["OSVDB-33629","CVE-2007-1765","CVE-2007-0038"]},"metasploit":null},{"id":"3617","name":"Microsoft Windows - Animated Cursor '.ani' Local Stack Overflow","source":"exploit-database","url":"https://www.exploit-db.com/exploits/3617","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"local","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"local","platform":"windows","file":"exploits/windows/local/3617.cpp","codes":["OSVDB-33629","CVE-2007-1765","CVE-2007-0038"]},"metasploit":null},{"id":"3688","name":"Microsoft Windows - GDI Privilege Escalation (MS07-017) (1)","source":"exploit-database","url":"https://www.exploit-db.com/exploits/3688","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"local","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"local","platform":"windows","file":"exploits/windows/local/3688.c","codes":["CVE-2007-1215","CVE-2007-1213","CVE-2007-1212","CVE-2007-1211","CVE-2007-0038","CVE-2006-5758","CVE-2006-5586","MS07-017"]},"metasploit":null},{"id":"3755","name":"Microsoft Windows - GDI Privilege Escalation (MS07-017) (2)","source":"exploit-database","url":"https://www.exploit-db.com/exploits/3755","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"local","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"local","platform":"windows","file":"exploits/windows/local/3755.c","codes":["CVE-2007-1215","CVE-2007-1213","CVE-2007-1212","CVE-2007-1211","CVE-2007-0038","CVE-2006-5758","CVE-2006-5586","MS07-017"]},"metasploit":null},{"id":"3804","name":"Microsoft Windows - '.ani' GDI Remote Privilege Escalation (MS07-017)","source":"exploit-database","url":"https://www.exploit-db.com/exploits/3804","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"windows","file":"exploits/windows/remote/3804.txt","codes":["CVE-2007-1215","CVE-2007-1213","CVE-2007-1212","CVE-2007-1211","CVE-2007-0038","CVE-2006-5758","CVE-2006-5586","MS07-017"]},"metasploit":null},{"id":"16526","name":"Microsoft Windows - ANI LoadAniIcon() Chunk Size Stack Buffer Overflow (HTTP) (MS07-017) (Metasploit)","source":"exploit-database","url":"https://www.exploit-db.com/exploits/16526","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"windows","file":"exploits/windows/remote/16526.rb","codes":["CVE-2007-0038","OSVDB-33629","MS07-017"]},"metasploit":null},{"id":"16698","name":"Microsoft Windows - ANI LoadAniIcon() Chunk Size Stack Buffer Overflow (SMTP) (MS07-017) (Metasploit)","source":"exploit-database","url":"https://www.exploit-db.com/exploits/16698","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"windows","file":"exploits/windows/remote/16698.rb","codes":["CVE-2007-1765","CVE-2007-0038","OSVDB-33629","MS07-017"]},"metasploit":null},{"id":"3636","name":"Microsoft Windows - Animated Cursor '.ani' Remote (eeye patch Bypass)","source":"exploit-database","url":"https://www.exploit-db.com/exploits/3636","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"windows","file":"exploits/windows/remote/3636.txt","codes":["OSVDB-33629","CVE-2007-1765","CVE-2007-0038"]},"metasploit":null},{"id":"3651","name":"Microsoft Windows - Animated Cursor '.ani' Universal Generator","source":"exploit-database","url":"https://www.exploit-db.com/exploits/3651","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"windows","file":"exploits/windows/remote/3651.txt","codes":["CVE-2007-0038","CVE-2007-1765"]},"metasploit":null},{"id":"4045","name":"Microsoft Windows - Animated Cursor Stack Overflow","source":"exploit-database","url":"https://www.exploit-db.com/exploits/4045","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"windows","file":"exploits/windows/remote/4045.py","codes":["CVE-2007-0038","CVE-2007-1765"]},"metasploit":null},{"id":"3635","name":"Microsoft Windows XP - Animated Cursor '.ani' Remote Overflow (2)","source":"exploit-database","url":"https://www.exploit-db.com/exploits/3635","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"windows","file":"exploits/windows/remote/3635.txt","codes":["OSVDB-33629","CVE-2007-1765","CVE-2007-0038"]},"metasploit":null},{"id":"3634","name":"Microsoft Windows XP/Vista - Animated Cursor '.ani' Remote Overflow","source":"exploit-database","url":"https://www.exploit-db.com/exploits/3634","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"windows","file":"exploits/windows/remote/3634.txt","codes":["OSVDB-33629","CVE-2007-1765","CVE-2007-0038"]},"metasploit":null},{"id":"MSF_EXPLOIT_WINDOWS_BROWSER_MS07_017_ANI_LOADIMAGE_CHUNKSIZE","name":"Windows ANI LoadAniIcon() Chunk Size Stack Buffer Overflow (HTTP)","source":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploit/windows/browser/ms07_017_ani_loadimage_chunksize.rb","maturity":"weaponized","reliabilityScore":0.8333333333333334,"verified":true,"type":"remote","platforms":[],"requiresAuth":false,"exploitdb":null,"metasploit":{"fullname":"exploit/windows/browser/ms07_017_ani_loadimage_chunksize","rank":"500","rankName":"great","postAuth":false,"check":false,"stability":["unknown-stability"],"sideEffects":["unknown-side-effects"],"reliability":["unknown-reliability"]}},{"id":"MSF_EXPLOIT_WINDOWS_EMAIL_MS07_017_ANI_LOADIMAGE_CHUNKSIZE","name":"Windows ANI LoadAniIcon() Chunk Size Stack Buffer Overflow (SMTP)","source":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploit/windows/email/ms07_017_ani_loadimage_chunksize.rb","maturity":"weaponized","reliabilityScore":0.8333333333333334,"verified":true,"type":"remote","platforms":[],"requiresAuth":false,"exploitdb":null,"metasploit":{"fullname":"exploit/windows/email/ms07_017_ani_loadimage_chunksize","rank":"500","rankName":"great","postAuth":false,"check":false,"stability":["unknown-stability"],"sideEffects":["unknown-side-effects"],"reliability":["unknown-reliability"]}}],"exploitCount":17,"weaknesses":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer","description":"The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/119.html"}],"affected":[{"vendor":"microsoft","product":"windows_2003_server","name":"windows 2003 server","label":"windows_2003_server","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"gold","noFixRecorded":false,"fixedIn":null},{"text":"sp1","noFixRecorded":false,"fixedIn":null},{"text":"sp2","noFixRecorded":false,"fixedIn":null}],"versionsText":"gold | sp1 | sp2","eol":null,"hubHref":"/vendor/microsoft/windows_2003_server"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://www.us-cert.gov/cas/techalerts/TA07-093A.html","label":"www.us-cert.gov/cas/techalerts/TA07-093A.html","hostname":"www.us-cert.gov","tags":["Third Party Advisory","X Refsource CERT","US Government Resource"]},{"url":"http://www.vupen.com/english/advisories/2007/1215","label":"www.vupen.com/english/advisories/2007/1215","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Vendor Advisory"]},{"url":"http://securityreason.com/securityalert/2542","label":"securityreason.com/securityalert/2542","hostname":"securityreason.com","tags":["Third Party Advisory","X Refsource SREASON"]},{"url":"http://archives.neohapsis.com/archives/fulldisclosure/2007-03/0470.html","label":"archives.neohapsis.com/archives/fulldisclosure/2007-03/0470.html","hostname":"archives.neohapsis.com","tags":["Mailing List","X Refsource FULLDISC"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1854","label":"oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1854","hostname":"oval.cisecurity.org","tags":["VDB Entry","Signature","X Refsource OVAL"]},{"url":"http://www.securityfocus.com/archive/1/464342/100/0/threaded","label":"www.securityfocus.com/archive/1/464342/100/0/threaded","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ"]},{"url":"http://www.kb.cert.org/vuls/id/191609","label":"www.kb.cert.org/vuls/id/191609","hostname":"www.kb.cert.org","tags":["Third Party Advisory","X Refsource CERT VN","US Government Resource"]},{"url":"http://www.securityfocus.com/archive/1/466186/100/200/threaded","label":"www.securityfocus.com/archive/1/466186/100/200/threaded","hostname":"www.securityfocus.com","tags":["Vendor Advisory","X Refsource HP"]},{"url":"http://secunia.com/advisories/24659","label":"secunia.com/advisories/24659","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA07-089A.html","label":"www.us-cert.gov/cas/techalerts/TA07-089A.html","hostname":"www.us-cert.gov","tags":["Third Party Advisory","X Refsource CERT","US Government Resource"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33301","label":"exchange.xforce.ibmcloud.com/vulnerabilities/33301","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF"]},{"url":"http://www.securityfocus.com/archive/1/464460/100/100/threaded","label":"www.securityfocus.com/archive/1/464460/100/100/threaded","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ"]},{"url":"http://www.determina.com/security_center/security_advisories/securityadvisory_0day_032907.asp","label":"www.determina.com/security_center/security_advisories/securityadvisory_0day_032907.asp","hostname":"www.determina.com","tags":["X Refsource MISC","Vendor Advisory"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-017","label":"docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-017","hostname":"docs.microsoft.com","tags":["Vendor Advisory","X Refsource MS"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA07-100A.html","label":"www.us-cert.gov/cas/techalerts/TA07-100A.html","hostname":"www.us-cert.gov","tags":["Third Party Advisory","X Refsource CERT","US Government Resource"]},{"url":"http://www.osvdb.org/33629","label":"www.osvdb.org/33629","hostname":"www.osvdb.org","tags":["VDB Entry","X Refsource OSVDB"]},{"url":"http://www.securityfocus.com/archive/1/464459/100/100/threaded","label":"www.securityfocus.com/archive/1/464459/100/100/threaded","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ"]},{"url":"http://www.securityfocus.com/archive/1/464269/100/0/threaded","label":"www.securityfocus.com/archive/1/464269/100/0/threaded","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ"]},{"url":"http://www.securityfocus.com/archive/1/464340/100/0/threaded","label":"www.securityfocus.com/archive/1/464340/100/0/threaded","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ"]},{"url":"http://www.securityfocus.com/archive/1/464339/100/0/threaded","label":"www.securityfocus.com/archive/1/464339/100/0/threaded","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2007-03-30T20:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-07T12:03:36.879Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T10:44:43.699Z","stale":false,"partial":false}}