{"id":"CVE-2007-1765","aliases":["EUVD-2007-1759","GHSA-f56g-48jx-gg6q"],"status":"published","title":"Unspecified vulnerability in Microsoft Windows 2000 SP4 through Vista allows remote attackers to...","description":"Unspecified vulnerability in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code or cause a denial of service (persistent reboot) via a malformed ANI file, which results in memory corruption when processing cursors, animated cursors, and icons, a similar issue to CVE-2005-0416, as originally demonstrated using Internet Explorer 6 and 7.  NOTE: this issue might be a duplicate of CVE-2007-0038; if so, then use CVE-2007-0038 instead of this identifier.","severity":{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.54853,"percentile":0.9903,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"published":"2007-03-30T00:00:00Z","modified":"2026-06-16T22:38:15Z","exploits":[{"source":"exploitdb","id":"EDB-16698","title":"Microsoft Windows - ANI LoadAniIcon() Chunk Size Stack Buffer Overflow (SMTP) (MS07-017) (Metasploit)","type":"remote","platform":"windows","date":"2010-09-20","verified":true,"url":"https://www.exploit-db.com/exploits/16698"},{"source":"exploitdb","id":"EDB-3617","title":"Microsoft Windows - Animated Cursor '.ani' Local Stack Overflow","type":"local","platform":"windows","date":"2007-03-31","verified":true,"url":"https://www.exploit-db.com/exploits/3617"},{"source":"exploitdb","id":"EDB-3634","title":"Microsoft Windows XP/Vista - Animated Cursor '.ani' Remote Overflow","type":"remote","platform":"windows","date":"2007-04-01","verified":true,"url":"https://www.exploit-db.com/exploits/3634"},{"source":"exploitdb","id":"EDB-3635","title":"Microsoft Windows XP - Animated Cursor '.ani' Remote Overflow (2)","type":"remote","platform":"windows","date":"2007-04-01","verified":true,"url":"https://www.exploit-db.com/exploits/3635"},{"source":"exploitdb","id":"EDB-3636","title":"Microsoft Windows - Animated Cursor '.ani' Remote (eeye patch Bypass)","type":"remote","platform":"windows","date":"2007-04-01","verified":true,"url":"https://www.exploit-db.com/exploits/3636"},{"source":"exploitdb","id":"EDB-3647","title":"Microsoft Windows - Animated Cursor '.ani' Local Buffer Overflow","type":"local","platform":"windows","date":"2007-04-02","verified":true,"url":"https://www.exploit-db.com/exploits/3647"},{"source":"exploitdb","id":"EDB-3651","title":"Microsoft Windows - Animated Cursor '.ani' Universal Generator","type":"remote","platform":"windows","date":"2007-04-03","verified":true,"url":"https://www.exploit-db.com/exploits/3651"},{"source":"exploitdb","id":"EDB-3652","title":"Microsoft Windows - Animated Cursor '.ani' Local Overflow (Hardware DEP)","type":"local","platform":"windows","date":"2007-04-03","verified":true,"url":"https://www.exploit-db.com/exploits/3652"},{"source":"exploitdb","id":"EDB-3684","title":"Microsoft Windows Explorer - '.ANI' File Denial of Service","type":"dos","platform":"windows","date":"2007-04-08","verified":true,"url":"https://www.exploit-db.com/exploits/3684"},{"source":"exploitdb","id":"EDB-3695","title":"Microsoft Windows - Animated Cursor '.ani' Local Overflow","type":"local","platform":"windows","date":"2007-04-09","verified":true,"url":"https://www.exploit-db.com/exploits/3695"},{"source":"exploitdb","id":"EDB-4045","title":"Microsoft Windows - Animated Cursor Stack Overflow","type":"remote","platform":"windows","date":"2007-06-07","verified":true,"url":"https://www.exploit-db.com/exploits/4045"},{"source":"metasploit","id":"exploit/windows/email/ms07_017_ani_loadimage_chunksize","title":"Windows ANI LoadAniIcon() Chunk Size Stack Buffer Overflow (SMTP)","type":"exploit","platform":"Windows","date":"2007-03-28","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/windows/email/ms07_017_ani_loadimage_chunksize"}],"products":[{"vendor":"avaya","product":"definity_one_media_server"},{"vendor":"avaya","product":"ip600_media_servers"},{"vendor":"avaya","product":"s3400"},{"vendor":"avaya","product":"s8100"},{"vendor":"microsoft","product":"ie"},{"vendor":"microsoft","product":"internet_explorer"},{"vendor":"microsoft","product":"windows_2000"},{"vendor":"microsoft","product":"windows_2003_server"},{"vendor":"microsoft","product":"windows_vista"},{"vendor":"microsoft","product":"windows_xp"}],"references":[{"url":"http://www.securityfocus.com/archive/1/464287/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://research.eeye.com/html/alerts/zeroday/20070328.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"http://www.securityfocus.com/archive/1/464345/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://www.vupen.com/english/advisories/2007/1151","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Third Party Advisory"]},{"url":"http://vil.nai.com/vil/content/v_141860.htm","tags":["x_refsource_MISC","x_transferred","Broken Link"]},{"url":"http://www.avertlabs.com/research/blog/?p=230","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/23194","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.microsoft.com/technet/security/advisory/935423.mspx","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://www.securitytracker.com/id?1017827","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.avertlabs.com/research/blog/?p=233","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"http://asert.arbornetworks.com/2007/03/any-ani-file-could-infect-you/","tags":["x_refsource_MISC","x_transferred","Broken Link"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-1765"},{"url":"http://asert.arbornetworks.com/2007/03/any-ani-file-could-infect-you"},{"url":"https://github.com/advisories/GHSA-f56g-48jx-gg6q"}],"sources":{"cve":[{"id":"CVE-2007-1765","description":"Unspecified vulnerability in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code or cause a denial of service (persistent reboot) via a malformed ANI file, which results in memory corruption when processing cursors, animated cursors, and icons, a similar issue to CVE-2005-0416, as originally demonstrated using Internet Explorer 6 and 7.  NOTE: this issue might be a duplicate of CVE-2007-0038; if so, then use CVE-2007-0038 instead of this identifier.","status":"published","published":"2007-03-30T00:00:00Z","modified":"2024-08-07T13:06:26.389Z","updated_at":"2026-11-02T13:33:52.669326Z"}],"euvd":[{"id":"EUVD-2007-1759","description":"Unspecified vulnerability in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code or cause a denial of service (persistent reboot) via a malformed ANI file, which results in memory corruption when processing cursors, animated cursors, and icons, a similar issue to CVE-2005-0416, as originally demonstrated using Internet Explorer 6 and 7.  NOTE: this issue might be a duplicate of CVE-2007-0038; if so, then use CVE-2007-0038 instead of this identifier.","status":"published","published":"2007-03-30T00:00:00Z","modified":"2024-08-07T13:06:26Z","updated_at":"2026-11-03T01:38:24.288842Z"}],"ghsa":[{"id":"GHSA-f56g-48jx-gg6q","title":"Unspecified vulnerability in Microsoft Windows 2000 SP4 through Vista allows remote attackers to...","description":"Unspecified vulnerability in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code or cause a denial of service (persistent reboot) via a malformed ANI file, which results in memory corruption when processing cursors, animated cursors, and icons, a similar issue to CVE-2005-0416, as originally demonstrated using Internet Explorer 6 and 7.  NOTE: this issue might be a duplicate of CVE-2007-0038; if so, then use CVE-2007-0038 instead of this identifier.","status":"published","published":"2022-05-01T17:56:48Z","modified":"2025-04-09T03:40:36Z","updated_at":"2026-11-02T15:00:53.302842Z"}],"nvd":[{"id":"CVE-2007-1765","description":"Unspecified vulnerability in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code or cause a denial of service (persistent reboot) via a malformed ANI file, which results in memory corruption when processing cursors, animated cursors, and icons, a similar issue to CVE-2005-0416, as originally demonstrated using Internet Explorer 6 and 7.  NOTE: this issue might be a duplicate of CVE-2007-0038; if so, then use CVE-2007-0038 instead of this identifier.","status":"published","published":"2007-03-30T00:19:00Z","modified":"2026-06-16T22:38:15.003Z","cvss":[{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:01:14.732044Z"}]}}