CVE-2007-0039
The Exchange Collaboration Data Objects (EXCDO) functionality in Microsoft Exchange Server 2000...
The Exchange Collaboration Data Objects (EXCDO) functionality in Microsoft Exchange Server 2000 SP3, 2003 SP1 and SP2, and 2007 allows remote attackers to cause a denial of service (crash) via an Internet Calendar (iCal) file containing multiple X-MICROSOFT-CDO-MODPROPS (MODPROPS) properties in which the second MODPROPS is longer than the first, which triggers a NULL pointer dereference and an unhandled exception.
Exploit likelihood
What each source reports
NVD Score used
The Exchange Collaboration Data Objects (EXCDO) functionality in Microsoft Exchange Server 2000 SP3, 2003 SP1 and SP2, and 2007 allows remote attackers to cause a denial of service (crash) via an Internet Calendar (iCal) file containing multiple X-MICROSOFT-CDO-MODPROPS (MODPROPS) properties in which the second MODPROPS is longer than the first, which triggers a NULL pointer dereference and an unhandled exception.
- Record
CVE-2007-0039- CVSS 2.0
- 7.8 High
AV:N/AC:L/Au:N/C:N/I:N/A:C - Weakness
- CWE-476
- Updated
- 2026-11-02
CVE List No score
The Exchange Collaboration Data Objects (EXCDO) functionality in Microsoft Exchange Server 2000 SP3, 2003 SP1 and SP2, and 2007 allows remote attackers to cause a denial of service (crash) via an Internet Calendar (iCal) file containing multiple X-MICROSOFT-CDO-MODPROPS (MODPROPS) properties in which the second MODPROPS is longer than the first, which triggers a NULL pointer dereference and an unhandled exception.
- Record
CVE-2007-0039- Updated
- 2026-11-02
EUVDEUVD-2007-0043 No score
The Exchange Collaboration Data Objects (EXCDO) functionality in Microsoft Exchange Server 2000 SP3, 2003 SP1 and SP2, and 2007 allows remote attackers to cause a denial of service (crash) via an Internet Calendar (iCal) file containing multiple X-MICROSOFT-CDO-MODPROPS (MODPROPS) properties in which the second MODPROPS is longer than the first, which triggers a NULL pointer dereference and an unhandled exception.
- Record
EUVD-2007-0043- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wphx-9m7p-vhwc No score
The Exchange Collaboration Data Objects (EXCDO) functionality in Microsoft Exchange Server 2000...
The Exchange Collaboration Data Objects (EXCDO) functionality in Microsoft Exchange Server 2000 SP3, 2003 SP1 and SP2, and 2007 allows remote attackers to cause a denial of service (crash) via an Internet Calendar (iCal) file containing multiple X-MICROSOFT-CDO-MODPROPS (MODPROPS) properties in which the second MODPROPS is longer than the first, which triggers a NULL pointer dereference and an unhandled exception.
- Record
GHSA-wphx-9m7p-vhwc- Weakness
- CWE-476
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-0039 is a high vulnerability (CVSS 7.8) in Microsoft Exchange Server, published May 8, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 44.6%, the 98th percentile. No source names a fixed version.
References
securityfocus.com/archive/1/468047/100/0/threaded
securitytracker.com/id?1018015
docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-026
osvdb.org/34390
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1593
Show 9 moreShow less
secunia.com/advisories/25183
us-cert.gov/cas/techalerts/TA07-128A.html
exchange.xforce.ibmcloud.com/vulnerabilities/33888
vupen.com/english/advisories/2007/1711
determina.com/security.research/vulnerabilities/exchange-ical-modprops.html
lists.grok.org.uk/pipermail/full-disclosure/2007-May/063232.html
nvd.nist.gov/vuln/detail/CVE-2007-0039
github.com/advisories/GHSA-wphx-9m7p-vhwc