CVE-2007-2216

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 41.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-08-14 · updated 2026-06-16
Weakness: CWE-16

Description

The tblinf32.dll (aka vstlbinf.dll) ActiveX control for Internet Explorer 5.01, 6 SP1, and 7 uses an incorrect IObjectsafety implementation, which allows remote attackers to execute arbitrary code by requesting the HelpString property, involving a crafted DLL file argument to the TypeLibInfoFromFile function, which overwrites the HelpStringDll property to call the DLLGetDocumentation function in another DLL file, aka "ActiveX Object Vulnerability."

Affected products

Microsoft Internet Explorer 11: 5.01, 6-sp1, 7

References

http://secunia.com/advisories/26419
http://securitytracker.com/id?1018562
http://www.osvdb.org/36396
http://www.securityfocus.com/archive/1/476742/100/0/threaded
http://www.securityfocus.com/bid/25289
http://www.us-cert.gov/cas/techalerts/TA07-226A.html
http://www.vupen.com/english/advisories/2007/2869
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-045
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2109
http://secunia.com/advisories/26419
http://securitytracker.com/id?1018562
http://www.osvdb.org/36396

Get alerted when CVE-2007-2216 or the next vulnerability affects your stack