CVE-2007-0671

Home/CVE/Microsoft Office Excel Remote Code Execution Vulnerability

CVE

Microsoft Office Excel Remote Code Execution Vulnerability

Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Office products, allows remote user-assisted attackers to execute arbitrary code via unknown attack vectors, as demonstrated by Exploit-MSExcel.h in targeted zero-day attacks.

HIGH · CVSS 8.8 ⚠ CISA KEV EPSS 0.52327

Act now

Listed on CISA KEV (known exploited in the wild)
SSVC exploitation status: active
EPSS ≥ 0.50 - high probability of exploitation in the next 30 days
EPSS percentile: top 2% of all CVEs by exploitation likelihood
CVSS base score ≥ 7.0

Sigma rules17 YARA rules0

⬢

Required Remediation

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

▤

Affected Products & Versions

microsoft accessall versions
microsoft excelall versions
microsoft excel viewerall versions
microsoft frontpageall versions
microsoft infopathall versions
microsoft officeall versions
microsoft onenoteall versions
microsoft outlookall versions
Show all 14 affected productsmicrosoft powerpointall versions
microsoft projectall versions
microsoft publisherall versions
microsoft visioall versions
microsoft wordall versions
microsoft word viewerall versions

◈

Sigma Hunt Rules

Exact rules name this CVE ID. Product rules name an affected product in their title. Related rules cover techniques used by actors who exploited this CVE. Showing the most relevant matches; the complete related set is on the full drill-down.

producthighSuspicious File Created in Outlook Temporary Directory

producthighSuspicious Outlook Macro Created

producthighPotential Persistence Via Outlook Form

producthighSuspicious Execution From Outlook Temporary Folder

producthighSuspicious Remote Child Process From Outlook

producthighSuspicious Outlook Child Process

Show all 17 top matchesproducthighOutlook EnableUnsafeClientMailRules Setting Enabled
producthighPotential Persistence Via Outlook LoadMacroProviderOnBoot Setting
productlowBitbucket Project Secret Scanning Allowlist Added
producthighSuspicious Microsoft Office Child Process - MacOS
producthighCode Executed Via Office Add-in XLL File
producthighPotential Persistence Via Microsoft Office Add-In
producthighPotential Persistence Via Microsoft Office Startup Folder
producthighFile With Uncommon Extension Created By An Office Application
producthighOffice Macro File Creation From Suspicious Process
producthighUncommon File Created In Office Startup Folder
producthighPotentially Suspicious Office Document Executed From Trusted Location