CVE-2007-0671

HIGH

8.8

CVSS Score

Published: February 3, 2007 at 01:00 AM UTC

Updated: June 16, 2026 at 10:36 PM UTC

14 products affected across 1 vendorOfficeExcelWord

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.8

Exploitation

CISA KEV

Exploit prediction

EPSS 43%

SSVC

Active

Actively Exploited

CISA Known Exploited Vulnerabilities (KEV) Catalog

EPSS Score43.2%

EPSS (Exploit Prediction Scoring System) estimates a 43.2% chance this CVE is exploited in the wild within the next 30 days — higher than 99% of all CVEs. It complements CVSS: a high EPSS on a mid-severity CVE can still be urgent.

Microsoft Office Excel contains a remote code execution vulnerability that can be exploited when a specially crafted Excel file is opened. This malicious file could be delivered as an email attachment or hosted on a malicious website. An attacker could leverage this vulnerability by creating a specially crafted Excel file, which, when opened, allowing an attacker to execute remote code on the affected system.

Required Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Ransomware Use

Unknown

Added to KEV

Aug 12, 2025

Remediation Due

Sep 2, 2025

419 days overdue

Notes

https://learn.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-015

https://nvd.nist.gov/vuln/detail/CVE-2007-0671

Description

Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Office products, allows remote user-assisted attackers to execute arbitrary code via unknown attack vectors, as demonstrated by Exploit-MSExcel.h in targeted zero-day attacks.