CVE-2007-0447

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-10-05 · updated 2026-06-16
Weakness: CWE-119

Description

Heap-based buffer overflow in the Decomposer component in multiple Symantec products allows remote attackers to execute arbitrary code via multiple crafted CAB archives.

Affected products

Symantec Antivirus Scan Engine: 4.0, 4.1, 4.1.8, 4.3, 4.3.3, 4.3.7.27 (+4)
Symantec Brightmail Antispam: 4.0, 5.5, 6.0, 6.0.1, 6.0.2, 6.0.3 (+1)
Symantec Client Security: 2.0, 2.0-build_9.0.0.338, 2.0.1_build_9.0.1.1000-mr1, 2.0.2_build_9.0.2.1000-mr2, 2.0.3_build_9.0.3.1000-mr3, 2.0.4 (+21)
Symantec Gateway Security 5000 Series: 3.0.1
Symantec Gateway Security 5400: 2.0.1
Symantec Mail Security: 4.0, 4.0-build456, 4.0-build463, 4.0-build465, 4.0-build736, 4.0-build741 (+18)
Symantec Mail Security 8820 Appliance: all versions
Symantec Norton Antivirus: 9.0, 9.0.0, 9.0.0.338, 9.0.1, 9.0.1.1.1000, 9.0.2 (+36)
Symantec Norton Internet Security: 3.0, 2004, 2005, 2005-11.0, 2005-11.0.9, 2005-11.5.6.14 (+1)
Symantec Norton Personal Firewall: 2006, 2006_9.1.0.33, 2006_9.1.1.7
Symantec Norton System Works: 3.0, 2004, 2005, 2005-11.0, 2005-11.0.9, 2006
Symantec Antivirus Filtering +For Domino: 3.0.12
Symantec Web Security: 2.5, 3.0, 3.0.1, 3.0.1.70, 3.0.1.76, 3.0.1_build_3.01.70 (+10)

References

Get alerted when CVE-2007-0447 or the next vulnerability affects your stack