$ cve CVE-2007-2223 JSON

CVE-2007-2223 EXPLOIT

9.3

HIGH · CVSS 2.0 · EPSS 48.7% (pctl 99)

Patch early

A public exploit exists.

Description

Microsoft XML Core Services (MSXML) 3.0 through 6.0 allows remote attackers to execute arbitrary code via the substringData method on a (1) TextNode or (2) XMLDOM object, which causes an integer overflow that leads to a buffer overflow.

Scoring

CVSS	9.3 (HIGH, v2.0)
Vector	AV:N/AC:M/Au:N/C:C/I:C/A:C
EPSS	48.72% — more likely to be exploited than 99% of all CVEs
Weakness	CWE-119
On CISA KEV	no
Public exploit	yes
Published	2007-08-14
Last modified	2026-06-16

Affected (11)

Vendor	Product
microsoft	expression web
microsoft	office
microsoft	office compatibility pack
microsoft	office groove server
microsoft	office sharepoint server
microsoft	windows server 2003
microsoft	windows server 2008
microsoft	windows vista
microsoft	windows xp
microsoft	word viewer
microsoft	xml core services

Public exploits

Source	Title	Date
exploit-db	Microsoft XML Core Services 6.0 - SubstringData Integer Overflow	2007-08-14

References

→ the Explorer · watch your stack · NVD