CVE-2007-0671highunder attack

CVE-2007-0671

Published · Updated

Follow this CVE+ Monitor Microsoft Office

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has an official Brazilian government alert.

ssvc Actcvss 8.8epss 44%
from disclosure to weapon
Published on NVDFeb 3
CISA KEV+6765d
Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

  • CTIR Gov · ALERTA 14/2025Vulnerabilidade crítica no Office da Microsoftread on gov.br ↗
Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
Action required by CISAfederal deadline: 2025-09-02

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

Microsoft Excel versions 2000, XP, 2003, and 2004 for Mac contain an unspecified flaw that allows attackers to run malicious code on a user's computer when they open a specially crafted Excel file. This vulnerability was actively exploited in real-world attacks before a fix was available.

Technical detail

An unspecified vulnerability in Excel 2000, XP, 2003, and 2004 for Mac allows remote code execution through user-assisted attack vectors (opening a malicious document). The vulnerability was demonstrated in targeted zero-day exploits before disclosure, indicating active exploitation in the wild with no prior warning.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Office products, allows remote user-assisted attackers to execute arbitrary code via unknown attack vectors, as demonstrated by Exploit-MSExcel.h in targeted zero-day attacks.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
n/a · n/a