{"id":"CVE-2007-3896","aliases":["EUVD-2007-3880","GHSA-wmhg-7fm8-r4vp"],"status":"published","title":"The URL handling in Shell32.dll in the Windows shell in Microsoft Windows XP and Server 2003,...","description":"The URL handling in Shell32.dll in the Windows shell in Microsoft Windows XP and Server 2003, with Internet Explorer 7 installed, allows remote attackers to execute arbitrary programs via invalid \"%\" sequences in a mailto: or other URI handler, as demonstrated using mIRC, Outlook, Firefox, Adobe Reader, Skype, and other applications. NOTE: this issue might be related to other issues involving URL handlers in Windows systems, such as CVE-2007-3845. There also might be separate but closely related issues in the applications that are invoked by the handlers.","severity":{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.53831,"percentile":0.99006,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-20"],"published":"2007-10-11T00:00:00Z","modified":"2026-06-16T22:42:59Z","exploits":[{"source":"exploitdb","id":"EDB-30645","title":"Microsoft Windows - URI Handler Command Execution","type":"remote","platform":"windows","date":"2007-10-05","verified":true,"url":"https://www.exploit-db.com/exploits/30645"}],"products":[{"vendor":"microsoft","product":"internet_explorer"}],"references":[{"url":"http://www.securityfocus.com/archive/1/482437/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://marc.info/?l=full-disclosure\u0026m=119159477404263\u0026w=2","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"]},{"url":"http://www.securityfocus.com/archive/1/481871/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://www.heise-security.co.uk/news/96982","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://www.securityfocus.com/archive/1/481680/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://www.securityfocus.com/archive/1/481664/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://marc.info/?l=bugtraq\u0026m=119159924712561\u0026w=2","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://blogs.zdnet.com/security/?p=577","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://www.securityfocus.com/archive/1/481867/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://www.securityfocus.com/archive/1/484186/100/0/threaded","tags":["vendor-advisory","x_refsource_HP","x_transferred"]},{"url":"http://secunia.com/advisories/26201","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=119168062128026\u0026w=2","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://marc.info/?l=full-disclosure\u0026m=119171444628628\u0026w=2","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4581","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred"]},{"url":"http://xs-sniper.com/blog/remote-command-exec-firefox-2005/","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://marc.info/?l=full-disclosure\u0026m=119175323322021\u0026w=2","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"]},{"url":"http://www.securityfocus.com/archive/1/481846/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://securitytracker.com/id?1018831","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://marc.info/?l=bugtraq\u0026m=119194714125580\u0026w=2","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://marc.info/?l=full-disclosure\u0026m=119168727402084\u0026w=2","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"]},{"url":"http://www.securityfocus.com/archive/1/481881/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://www.securityfocus.com/archive/1/481671/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://www.securityfocus.com/archive/1/481839/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA07-317A.html","tags":["third-party-advisory","x_refsource_CERT","x_transferred","US Government Resource"]},{"url":"http://marc.info/?l=full-disclosure\u0026m=119180333805950\u0026w=2","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"]},{"url":"http://www.microsoft.com/technet/security/advisory/943521.mspx","tags":["vendor-advisory","x_refsource_MSKB","x_transferred"]},{"url":"http://www.securityfocus.com/archive/1/481493/100/100/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://www.securityfocus.com/archive/1/481624/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-061","tags":["vendor-advisory","x_refsource_MS","x_transferred"]},{"url":"http://www.securityfocus.com/bid/25945","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.securityfocus.com/archive/1/481887/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://www.securityfocus.com/archive/1/482292/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://www.kb.cert.org/vuls/id/403150","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","US Government Resource"]},{"url":"http://www.securityfocus.com/archive/1/482090/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://marc.info/?l=bugtraq\u0026m=119143780202107\u0026w=2","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://www.securityfocus.com/archive/1/481505/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://marc.info/?l=bugtraq\u0026m=119195904813505\u0026w=2","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://marc.info/?l=full-disclosure\u0026m=119170531020020\u0026w=2","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"]},{"url":"http://marc.info/?l=bugtraq\u0026m=119144449915918\u0026w=2","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://www.securitytracker.com/id?1018822","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-3896"},{"url":"http://xs-sniper.com/blog/remote-command-exec-firefox-2005"},{"url":"https://github.com/advisories/GHSA-wmhg-7fm8-r4vp"}],"sources":{"cve":[{"id":"CVE-2007-3896","description":"The URL handling in Shell32.dll in the Windows shell in Microsoft Windows XP and Server 2003, with Internet Explorer 7 installed, allows remote attackers to execute arbitrary programs via invalid \"%\" sequences in a mailto: or other URI handler, as demonstrated using mIRC, Outlook, Firefox, Adobe Reader, Skype, and other applications. NOTE: this issue might be related to other issues involving URL handlers in Windows systems, such as CVE-2007-3845. There also might be separate but closely related issues in the applications that are invoked by the handlers.","status":"published","published":"2007-10-11T00:00:00Z","modified":"2024-08-07T14:37:04.553Z","updated_at":"2026-11-02T13:32:56.730199Z"}],"euvd":[{"id":"EUVD-2007-3880","description":"The URL handling in Shell32.dll in the Windows shell in Microsoft Windows XP and Server 2003, with Internet Explorer 7 installed, allows remote attackers to execute arbitrary programs via invalid \"%\" sequences in a mailto: or other URI handler, as demonstrated using mIRC, Outlook, Firefox, Adobe Reader, Skype, and other applications. NOTE: this issue might be related to other issues involving URL handlers in Windows systems, such as CVE-2007-3845. There also might be separate but closely related issues in the applications that are invoked by the handlers.","status":"published","published":"2007-10-11T00:00:00Z","modified":"2024-08-07T14:37:04Z","updated_at":"2026-11-03T01:16:24.023061Z"}],"ghsa":[{"id":"GHSA-wmhg-7fm8-r4vp","title":"The URL handling in Shell32.dll in the Windows shell in Microsoft Windows XP and Server 2003,...","description":"The URL handling in Shell32.dll in the Windows shell in Microsoft Windows XP and Server 2003, with Internet Explorer 7 installed, allows remote attackers to execute arbitrary programs via invalid \"%\" sequences in a mailto: or other URI handler, as demonstrated using mIRC, Outlook, Firefox, Adobe Reader, Skype, and other applications. NOTE: this issue might be related to other issues involving URL handlers in Windows systems, such as CVE-2007-3845. There also might be separate but closely related issues in the applications that are invoked by the handlers.","status":"published","published":"2022-05-01T18:18:29Z","modified":"2025-04-09T03:48:12Z","cwes":["CWE-20"],"updated_at":"2026-11-02T15:00:55.503486Z"}],"nvd":[{"id":"CVE-2007-3896","description":"The URL handling in Shell32.dll in the Windows shell in Microsoft Windows XP and Server 2003, with Internet Explorer 7 installed, allows remote attackers to execute arbitrary programs via invalid \"%\" sequences in a mailto: or other URI handler, as demonstrated using mIRC, Outlook, Firefox, Adobe Reader, Skype, and other applications. NOTE: this issue might be related to other issues involving URL handlers in Windows systems, such as CVE-2007-3845. There also might be separate but closely related issues in the applications that are invoked by the handlers.","status":"published","published":"2007-10-11T00:17:00Z","modified":"2026-06-16T22:42:59.39Z","cvss":[{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:01:21.141213Z"}]}}