CVE-2007-2237

MEDIUM

Microsoft Windows XP - Denial of Service via ICO File with Zero Height

Title source: llm

Exploitation Summary

EIP tracks 2 public exploits for CVE-2007-2237. PoCs published by Kad, Dennis Rand.

AI-analyzed exploit summary This is a writeup describing a Microsoft GDI+ integer division by zero flaw in handling .ICO files (CVE-2007-2237). It references an external binary exploit but does not contain functional exploit code itself.

Description

Microsoft Windows Graphics Device Interface (GDI+, GdiPlus.dll) allows context-dependent attackers to cause a denial of service (crash) via an ICO file with an InfoHeader containing a Height of zero, which triggers a divide-by-zero error.

Exploits (2)

exploitdb WRITEUP VERIFIED

by Kad · textdoswindows

https://www.exploit-db.com/exploits/4044

View Code ZIP pw:eip

This is a writeup describing a Microsoft GDI+ integer division by zero flaw in handling .ICO files (CVE-2007-2237). It references an external binary exploit but does not contain functional exploit code itself.

Classification

Writeup 90%

Attack Type

Dos

Complexity

Trivial

Reliability

Theoretical

Target: Microsoft GDI+ (affected versions)

No auth needed

Prerequisites: Vulnerable Microsoft GDI+ installation · Ability to deliver a malicious .ICO file

MITRE ATT&CK

T1499 - Endpoint Denial of Service

devstral-2 · analyzed Feb 16, 2026 Full analysis →

exploitdb WRITEUP VERIFIED

by Dennis Rand · textdoswindows

https://www.exploit-db.com/exploits/30160

View Code ZIP pw:eip

The provided text describes a remote denial-of-service vulnerability in Microsoft Windows due to improper handling of maliciously crafted ICO files. Exploitation involves tricking victims into opening a malicious file, leading to DoS conditions in applications like Windows Explorer.