CVE-2007-3897

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 54.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-10-09 · updated 2026-06-16
Weakness: CWE-119

Description

Heap-based buffer overflow in Microsoft Outlook Express 6 and earlier, and Windows Mail for Vista, allows remote Network News Transfer Protocol (NNTP) servers to execute arbitrary code via long NNTP responses that trigger memory corruption.

Affected products

Microsoft Outlook Express: through 6.0; 6.0-sp1
Microsoft Windows Mail: all versions

References

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=607
http://secunia.com/advisories/27112
http://securitytracker.com/id?1018785
http://securitytracker.com/id?1018786
http://www.securityfocus.com/archive/1/481983/100/100/threaded
http://www.securityfocus.com/archive/1/482366/100/0/threaded
http://www.securityfocus.com/bid/25908
http://www.us-cert.gov/cas/techalerts/TA07-282A.html
http://www.vupen.com/english/advisories/2007/3436
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-056
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1706
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=607

Get alerted when CVE-2007-3897 or the next vulnerability affects your stack