$ cve CVE-2007-6387 JSON

CVE-2007-6387 EXPLOIT

9.3

HIGH · CVSS 2.0 · EPSS 38% (pctl 99)

Patch early

A public exploit exists.

Description

Multiple stack-based buffer overflows in the awApi4.AnswerWorks.1 ActiveX control in awApi4.dll 4.0.0.42, as used by Vantage Linguistics AnswerWorks, and Intuit Clearly Bookkeeping, ProSeries, QuickBooks, Quicken, QuickTax, and TurboTax, allow remote attackers to execute arbitrary code via long arguments to the (1) GetHistory, (2) GetSeedQuery, (3) SetSeedQuery, and possibly other methods. NOTE: some of these details are obtained from third party information.

Scoring

CVSS	9.3 (HIGH, v2.0)
Vector	AV:N/AC:M/Au:N/C:C/I:C/A:C
EPSS	38.03% — more likely to be exploited than 99% of all CVEs
Weakness	CWE-119
On CISA KEV	no
Public exploit	yes
Published	2007-12-15
Last modified	2026-06-16

Affected (8)

Vendor	Product
intuit	bookkeeping
intuit	proseries
intuit	quickbooks
intuit	quicken
intuit	quicktax
intuit	turbo tax
microsoft	activex
vantage linquistics	answerworks

Public exploits

Source	Title	Date
exploit-db	Vantage Linguistics AnswerWorks 4 - API ActiveX Control Buffer Overflow	2007-12-31

References

→ the Explorer · watch your stack · NVD