CVE-2007-2223

Microsoft XML Core Services 3.0-6.0 - Remote Code Execution via substringData Integer Overflow

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-2223. PoCs published by anonymous.

AI-analyzed exploit summary The code is a stub for CVE-2007-2223, demonstrating an integer overflow vulnerability in Microsoft XML Core Services. It includes commented-out JavaScript that would trigger the vulnerability but lacks a functional exploit.

Description

Microsoft XML Core Services (MSXML) 3.0 through 6.0 allows remote attackers to execute arbitrary code via the substringData method on a (1) TextNode or (2) XMLDOM object, which causes an integer overflow that leads to a buffer overflow.

Exploits (1)

exploitdb STUB VERIFIED
by anonymous · javascriptremotewindows
https://www.exploit-db.com/exploits/30493

The code is a stub for CVE-2007-2223, demonstrating an integer overflow vulnerability in Microsoft XML Core Services. It includes commented-out JavaScript that would trigger the vulnerability but lacks a functional exploit.

Classification
Stub 80%
Attack Type
Rce
Complexity
Trivial
Reliability
Theoretical
Target: Microsoft XML Core Services (MSXML)
No auth needed
Prerequisites: User interaction to visit a malicious webpage
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (11)

Core 11
Core References
Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/361968
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1018559
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/476747/100/0/threaded
Broken Link third-party-advisory x_refsource_idefense
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=576
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2007/2866
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/476527/100/0/threaded
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/25301
Patch, Vendor Advisory vendor-advisory x_refsource_ms
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-042
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/26447
Third Party Advisory, VDB Entry x_refsource_misc
http://www.zerodayinitiative.com/advisories/ZDI-07-048/

Scores

EPSS 0.4872
EPSS Percentile 98.7%

Details

CWE
CWE-119 CWE-190
Status published
Products (4)
microsoft/xml_core_services 3.0
microsoft/xml_core_services 4.0
microsoft/xml_core_services 6.0
microsoft/xml_core_services 5.0
Published Aug 14, 2007
Tracked Since Feb 18, 2026