CVE-2007-2386

Apple Mac OS X <10.4.9 - Buffer Overflow

Title source: llm

Exploitation Summary

EIP tracks 2 public exploits for CVE-2007-2386. PoCs published by Metasploit, ddz, including Metasploit module exploits/osx/mdns/upnp_location.

AI-analyzed exploit summary This Metasploit module exploits a buffer overflow in Mac OS X mDNSResponder (CVE-2007-2386) by sending a crafted UPnP response to trigger remote code execution. It targets vulnerable versions of Mac OS X 10.4.x and uses a UDP-based attack vector.

Description

Buffer overflow in mDNSResponder in Apple Mac OS X 10.4 up to 10.4.9 allows remote attackers to cause a denial of service (application termination) or execute arbitrary code via a crafted UPnP Internet Gateway Device (IGD) packet.

Exploits (2)

exploitdb WORKING POC VERIFIED

by Metasploit · rubyremoteosx

https://www.exploit-db.com/exploits/16871

View Code ZIP pw:eip

This Metasploit module exploits a buffer overflow in Mac OS X mDNSResponder (CVE-2007-2386) by sending a crafted UPnP response to trigger remote code execution. It targets vulnerable versions of Mac OS X 10.4.x and uses a UDP-based attack vector.

Classification

Working Poc 100%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: Mac OS X mDNSResponder (versions 10.4 to 10.4.9 without patch 2007-005)

No auth needed

Prerequisites: Network access to the target's UPnP service (port 1900) · Target running vulnerable Mac OS X version

MITRE ATT&CK

T1189 - Drive-by Compromise T1190 - Exploit Public-Facing Application

devstral-2 · analyzed Feb 16, 2026 Full analysis →

metasploit WORKING POC NORMAL

by ddz · rubypocosx

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/mdns/upnp_location.rb

View Code ZIP pw:eip

This Metasploit module exploits a buffer overflow in Mac OS X mDNSResponder (CVE-2007-2386) by sending a crafted UPnP response to trigger remote code execution. It targets specific offsets and architectures (x86/PPC) to overwrite function pointers and execute payloads.