CVE-2007-2225
A component in Microsoft Outlook Express 6 and Windows Mail in Windows Vista does not properly...
A component in Microsoft Outlook Express 6 and Windows Mail in Windows Vista does not properly handle certain HTTP headers when processing MHTML protocol URLs, which allows remote attackers to obtain sensitive information from other Internet Explorer domains, aka "URL Parsing Cross Domain Information Disclosure Vulnerability."
Exploit likelihood
What each source reports
NVD Score used
A component in Microsoft Outlook Express 6 and Windows Mail in Windows Vista does not properly handle certain HTTP headers when processing MHTML protocol URLs, which allows remote attackers to obtain sensitive information from other Internet Explorer domains, aka "URL Parsing Cross Domain Information Disclosure Vulnerability."
- Record
CVE-2007-2225- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
A component in Microsoft Outlook Express 6 and Windows Mail in Windows Vista does not properly handle certain HTTP headers when processing MHTML protocol URLs, which allows remote attackers to obtain sensitive information from other Internet Explorer domains, aka "URL Parsing Cross Domain Information Disclosure Vulnerability."
- Record
CVE-2007-2225- Updated
- 2026-11-02
EUVDEUVD-2007-2220 No score
A component in Microsoft Outlook Express 6 and Windows Mail in Windows Vista does not properly handle certain HTTP headers when processing MHTML protocol URLs, which allows remote attackers to obtain sensitive information from other Internet Explorer domains, aka "URL Parsing Cross Domain Information Disclosure Vulnerability."
- Record
EUVD-2007-2220- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8mcc-528j-m5qc No score
A component in Microsoft Outlook Express 6 and Windows Mail in Windows Vista does not properly...
A component in Microsoft Outlook Express 6 and Windows Mail in Windows Vista does not properly handle certain HTTP headers when processing MHTML protocol URLs, which allows remote attackers to obtain sensitive information from other Internet Explorer domains, aka "URL Parsing Cross Domain Information Disclosure Vulnerability."
- Record
GHSA-8mcc-528j-m5qc- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| aliases, references, title | GitHub Advisories | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-2225 is a medium vulnerability (CVSS 4.3) in Microsoft Outlook Express, published June 12, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 25.0%, the 97th percentile. No source names a fixed version.
References
docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-034
securitytracker.com/id?1018232
kb.cert.org/vuls/id/682825
securityfocus.com/archive/1/471947/100/0/threaded
openmya.hacker.jp/hasegawa/security/ms07-034.txt
Show 10 moreShow less
archive.openmya.devnull.jp/2007.06/msg00060.html
osvdb.org/35345
us-cert.gov/cas/techalerts/TA07-163A.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2045
secunia.com/advisories/25639
vupen.com/english/advisories/2007/2154
nvd.nist.gov/vuln/detail/CVE-2007-2225
github.com/advisories/GHSA-8mcc-528j-m5qc