{"schemaVersion":3,"id":"CVE-2007-3897","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Heap-based buffer overflow in Microsoft Outlook Express 6 and earlier, and Windows Mail for Vista, allows remote Network News Transfer Protocol (NNTP) servers to execute arbitrary code via long NNTP responses that trigger memory corruption.","dates":{"published":"2007-10-09T22:00:00.000Z","modified":"2024-08-07T14:37:05.670Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.3,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":9.3,"severity":"high","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.54631,"percentile":0.99013,"severity":"critical","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.54631},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.54631,"percentile":0.99013}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.54631,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.54631,"percentile":0.99013}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer","description":"The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/119.html"}],"affected":[{"vendor":"microsoft","product":"outlook_express","name":"outlook express","label":"outlook_express","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 6.0","noFixRecorded":false,"fixedIn":null},{"text":"6.0:sp1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 6.0 | 6.0:sp1","eol":null,"hubHref":"/vendor/microsoft/outlook_express"},{"vendor":"microsoft","product":"windows_mail","name":"windows mail","label":"windows_mail","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/microsoft/windows_mail"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://securitytracker.com/id?1018785","label":"securitytracker.com/id?1018785","hostname":"securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Third Party Advisory"]},{"url":"http://www.securityfocus.com/archive/1/482366/100/0/threaded","label":"www.securityfocus.com/archive/1/482366/100/0/threaded","hostname":"www.securityfocus.com","tags":["Vendor Advisory","X Refsource HP","Third Party Advisory","VDB Entry"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1706","label":"oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1706","hostname":"oval.cisecurity.org","tags":["VDB Entry","Signature","X Refsource OVAL","Third Party Advisory"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-056","label":"docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-056","hostname":"docs.microsoft.com","tags":["Vendor Advisory","X Refsource MS","Patch"]},{"url":"http://www.securityfocus.com/archive/1/481983/100/100/threaded","label":"www.securityfocus.com/archive/1/481983/100/100/threaded","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ","Third Party Advisory","VDB Entry"]},{"url":"http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=607","label":"labs.idefense.com/intelligence/vulnerabilities/display.php?id=607","hostname":"labs.idefense.com","tags":["Third Party Advisory","X Refsource IDEFENSE","Broken Link"]},{"url":"http://www.vupen.com/english/advisories/2007/3436","label":"www.vupen.com/english/advisories/2007/3436","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Permissions Required","Third Party Advisory"]},{"url":"http://securitytracker.com/id?1018786","label":"securitytracker.com/id?1018786","hostname":"securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/25908","label":"www.securityfocus.com/bid/25908","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Third Party Advisory"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA07-282A.html","label":"www.us-cert.gov/cas/techalerts/TA07-282A.html","hostname":"www.us-cert.gov","tags":["Third Party Advisory","X Refsource CERT","US Government Resource"]},{"url":"http://secunia.com/advisories/27112","label":"secunia.com/advisories/27112","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2007-10-09T22:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-07T14:37:05.670Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T18:01:09.045Z","stale":false,"partial":false}}