peter bassill · operator
$ cve CVE-2007-3901 JSON

CVE-2007-3901 EXPLOIT

8.5
HIGH · CVSS 2.0 · EPSS 45.9% (pctl 99)

Patch early

A public exploit exists.

Description

Stack-based buffer overflow in the DirectShow Synchronized Accessible Media Interchange (SAMI) parser in quartz.dll for Microsoft DirectX 7.0 through 10.0 allows remote attackers to execute arbitrary code via a crafted SAMI file.

Scoring

CVSS8.5 (HIGH, v2.0)
VectorAV:N/AC:M/Au:S/C:C/I:C/A:C
EPSS45.87% — more likely to be exploited than 99% of all CVEs
WeaknessCWE-119
On CISA KEVno
Public exploityes
Published2007-12-12
Last modified2026-06-16

Affected (5)

VendorProduct
microsoftdirectx
microsoftwindows 2000
microsoftwindows 2003 server
microsoftwindows vista
microsoftwindows xp

Public exploits

SourceTitleDate
exploit-dbMicrosoft DirectX DirectShow - SAMI Buffer Overflow (MS07-064) (Metasploit)2010-10-05
exploit-dbMicrosoft DirectX SAMI File Parsing - Remote Stack Overflow2008-01-08

References

→ the Explorer  ·  watch your stack  ·  NVD