CVE-2007-0051

Format string vulnerability in Apple iPhoto 6.0.5 (316), and other versions before 6.0.6, allows...

6.8 MediumPublic exploit

Format string vulnerability in Apple iPhoto 6.0.5 (316), and other versions before 6.0.6, allows remote user-assisted attackers to execute arbitrary code via a crafted photocast with format string specifiers in the title of an RSS iPhoto feed.

Exploit likelihood

9.34%Down 31.2 points since Feb 4, 2022

What each source reports

NVD Score used 6.8

Record: CVE-2007-0051
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-134
Updated: 2026-11-02

CVE List No score

Record: CVE-2007-0051
Updated: 2026-11-02

EUVDEUVD-2007-0055 No score

Record: EUVD-2007-0055
Updated: 2026-11-03

GitHub AdvisoriesGHSA-3655-xq3q-xq2p No score

Format string vulnerability in Apple iPhoto 6.0.5 (316), and other versions before 6.0.6, allows...

Record: GHSA-3655-xq3q-xq2p
Weakness: CWE-134
Updated: 2026-11-02

Affected products

apple iphoto

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	iLife iPhoto Photocast - XML Title Remote Format String (PoC)	2007-01-04

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2007-0051 is a medium vulnerability (CVSS 6.8) in Apple Iphoto, published January 4, 2007. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 9.34%, the 95th percentile. No source names a fixed version.

References

Show 9 moreShow less