$ cve CVE-2007-2216 JSON

CVE-2007-2216 EXPLOIT

9.3

HIGH · CVSS 2.0 · EPSS 41.4% (pctl 99)

Patch early

A public exploit exists.

Description

The tblinf32.dll (aka vstlbinf.dll) ActiveX control for Internet Explorer 5.01, 6 SP1, and 7 uses an incorrect IObjectsafety implementation, which allows remote attackers to execute arbitrary code by requesting the HelpString property, involving a crafted DLL file argument to the TypeLibInfoFromFile function, which overwrites the HelpStringDll property to call the DLLGetDocumentation function in another DLL file, aka "ActiveX Object Vulnerability."

Scoring

CVSS	9.3 (HIGH, v2.0)
Vector	AV:N/AC:M/Au:N/C:C/I:C/A:C
EPSS	41.39% — more likely to be exploited than 99% of all CVEs
Weakness	CWE-16
On CISA KEV	no
Public exploit	yes
Published	2007-08-14
Last modified	2026-06-16

Affected (1)

Vendor	Product
microsoft	internet explorer

Public exploits

Source	Title	Date
exploit-db	Microsoft Internet Explorer 5.0.1 - 'TBLinf32.dll' ActiveX Control Remote Code Execution	2007-05-08

References

→ the Explorer · watch your stack · NVD