CVE-2007-0671KEV · OVERDUE

Microsoft Office Excel Remote Code Execution Vulnerability

High · published February 3, 2007

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 98.7th percentile for exploit probability.

415
days past CISA
deadline
CVSS v3.1
8.8
EPSS
43%
Percentile
98.7
In the wild
Confirmed
What it is

🚨 A sneaky vulnerability lets attackers execute arbitrary code in Microsoft Excel with just a little user assistance! 🔥 Think of it as a trusted delivery service allowing a parcel full of surprises into your home — one moment, you're all set for a cozy evening, and the next, you're dealing with a mess you never expected! An attacker could entice a user to open a specially crafted Excel file, leading to unauthorized code execution. This could result in anything from data theft to complete system compromise, potentially wreaking absolute havoc on your information!

Put simply

Think of it as a trusted delivery service allowing a parcel full of surprises into your home — one moment, you're all set for a cozy evening, and the next, you're dealing with a mess you never expected! This unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac permits remote user-assisted attackers to execute arbitrary code through unknown attack vectors, as shown in targeted zero-day attacks.

What to do

An attacker could entice a user to open a specially crafted Excel file, leading to unauthorized code execution. This could result in anything from data theft to complete system compromise, potentially wreaking absolute havoc on your information! Immediately patch Microsoft Office to the latest available version to address this vulnerability. Educate users to be cautious about opening unsolicited Excel files, and consider implementing email filters to block potentially harmful attachments. 🛡️ You’ve got this! By following these steps, you can keep your systems safe and sound. 🦸‍♂️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.43241 · 98.7th percentile
Published
2007-02-03T01:00Z
KEV added
2025-08-12 · due 2025-09-02
EPSS history
Timeline
  • 12 AUG 00:00Z
    Added to CISA KEV — remediate by Sep 2
    kev
  • 03 FEB 01:00Z
    Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Office products, allows remote user-assisted attackers to…
    cvelistv5