CVE-2007-0675
A certain ActiveX control in sapi.dll (aka the Speech API) in Speech Components in Microsoft...
A certain ActiveX control in sapi.dll (aka the Speech API) in Speech Components in Microsoft Windows Vista, when the Speech Recognition feature is enabled, allows user-assisted remote attackers to delete arbitrary files, and conduct other unauthorized activities, via a web page with an embedded sound object that contains voice commands to an enabled microphone, allowing for interaction with Windows Explorer.
Exploit likelihood
What each source reports
NVD Score used
A certain ActiveX control in sapi.dll (aka the Speech API) in Speech Components in Microsoft Windows Vista, when the Speech Recognition feature is enabled, allows user-assisted remote attackers to delete arbitrary files, and conduct other unauthorized activities, via a web page with an embedded sound object that contains voice commands to an enabled microphone, allowing for interaction with Windows Explorer.
- Record
CVE-2007-0675- CVSS 2.0
- 7.6 High
AV:N/AC:H/Au:N/C:C/I:C/A:C - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List No score
A certain ActiveX control in sapi.dll (aka the Speech API) in Speech Components in Microsoft Windows Vista, when the Speech Recognition feature is enabled, allows user-assisted remote attackers to delete arbitrary files, and conduct other unauthorized activities, via a web page with an embedded sound object that contains voice commands to an enabled microphone, allowing for interaction with Windows Explorer.
- Record
CVE-2007-0675- Updated
- 2026-11-02
EUVDEUVD-2007-0672 No score
A certain ActiveX control in sapi.dll (aka the Speech API) in Speech Components in Microsoft Windows Vista, when the Speech Recognition feature is enabled, allows user-assisted remote attackers to delete arbitrary files, and conduct other unauthorized activities, via a web page with an embedded sound object that contains voice commands to an enabled microphone, allowing for interaction with Windows Explorer.
- Record
EUVD-2007-0672- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4jq3-gmvg-2rgg No score
A certain ActiveX control in sapi.dll (aka the Speech API) in Speech Components in Microsoft...
A certain ActiveX control in sapi.dll (aka the Speech API) in Speech Components in Microsoft Windows Vista, when the Speech Recognition feature is enabled, allows user-assisted remote attackers to delete arbitrary files, and conduct other unauthorized activities, via a web page with an embedded sound object that contains voice commands to an enabled microphone, allowing for interaction with Windows Explorer.
- Record
GHSA-4jq3-gmvg-2rgg- Weakness
- CWE-94
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-0675 is a high vulnerability (CVSS 7.6) in Microsoft Windows Vista, published February 3, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 18.2%, the 97th percentile. No source names a fixed version.
References
blogs.technet.com/msrc/archive/2007/01/31/issue-regarding-windows-vista-speech-recognition.aspx
secunia.com/advisories/30578
lists.immunitysec.com/pipermail/dailydave/2007-January/004012.html
securityfocus.com/bid/22359
us-cert.gov/cas/techalerts/TA08-162B.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5489
Show 9 moreShow less
marc.info?l=bugtraq&m=121380194923597&w=2
securitytracker.com/id?1020232
vupen.com/english/advisories/2008/1779/references
docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-032
nvd.nist.gov/vuln/detail/CVE-2007-0675
github.com/advisories/GHSA-4jq3-gmvg-2rgg