CVE-2007-3400

NCTAudioEditor and NCTAudioStudio - Arbitrary File Write via NCTWMAFile2.dll CreateFile Method

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-3400. PoCs published by shinnai.

AI-analyzed exploit summary This exploit targets an insecure method in NCTAudioEditor2 ActiveX DLL (NCTWMAFile2.dll v. 2.6.2.157) that allows arbitrary file creation via the CreateFile method. It demonstrates overwriting the system.ini file, which could lead to system instability or denial of service.

Description

The NCTAudioEditor2 ActiveX control in NCTWMAFile2.dll 2.6.2.157, as distributed in NCTAudioEditor and NCTAudioStudio 2.7, allows remote attackers to overwrite arbitrary files via the CreateFile method.

Exploits (1)

exploitdb WORKING POC VERIFIED
by shinnai · htmlremotewindows
https://www.exploit-db.com/exploits/4101

This exploit targets an insecure method in NCTAudioEditor2 ActiveX DLL (NCTWMAFile2.dll v. 2.6.2.157) that allows arbitrary file creation via the CreateFile method. It demonstrates overwriting the system.ini file, which could lead to system instability or denial of service.

Classification
Working Poc 90%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: NCTAudioEditor2 ActiveX DLL (NCTWMAFile2.dll v. 2.6.2.157)
No auth needed
Prerequisites: Victim must have the vulnerable ActiveX control installed and enabled in Internet Explorer
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (6)

Core 6
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/37674
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/24613
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/4101
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/35018
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/25825
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2007/2351

Scores

EPSS 0.0364
EPSS Percentile 88.1%

Details

CWE
CWE-20
Status published
Products (2)
nctsoft/nctaudioeditor _nil_
nctsoft/nctaudiostudio 2.7
Published Jun 26, 2007
Tracked Since Feb 18, 2026