{"api_version":"1","generated_at":"2026-07-23T11:17:14+00:00","cve":"CVE-2007-0947","urls":{"html":"https://cve.report/CVE-2007-0947","api":"https://cve.report/api/cve/CVE-2007-0947.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2007-0947","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2007-0947"},"summary":{"title":"CVE-2007-0947","description":"Use-after-free vulnerability in Microsoft Internet Explorer 7 on Windows XP SP2, Windows Server 2003 SP1 or SP2, or Windows Vista allows remote attackers to execute arbitrary code via crafted HTML objects, resulting in accessing deallocated memory of CMarkup objects, aka the second of two \"HTML Objects Memory Corruption Vulnerabilities\" and a different issue than CVE-2007-0946.","state":"PUBLISHED","assigner":"microsoft","published_at":"2007-05-08 23:19:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-399","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"9.3","severity":"","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:C/I:C/A:C","baseScore":9.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"}}],"references":[{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2048","name":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2048","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Repository  /  Oval Repository","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/34403","name":"http://www.osvdb.org/34403","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://secunia.com/advisories/23769","name":"http://secunia.com/advisories/23769","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"Internet Explorer Multiple Vulnerabilities - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/secunia_research/2007-36/advisory/","name":"http://secunia.com/secunia_research/2007-36/advisory/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"Internet Explorer HTML Objects Memory Corruption Vulnerability - Secunia Research - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-027","name":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-027","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Microsoft Security Bulletin MS07-027 - Critical | Microsoft Docs","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.us-cert.gov/cas/techalerts/TA07-128A.html","name":"http://www.us-cert.gov/cas/techalerts/TA07-128A.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["US Government Resource"],"title":"US-CERT Technical Cyber Security Alert TA07-128A -- Microsoft Updates for Multiple Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2007/1712","name":"http://www.vupen.com/english/advisories/2007/1712","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/468871/100/200/threaded","name":"http://www.securityfocus.com/archive/1/468871/100/200/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id?1018019","name":"http://www.securitytracker.com/id?1018019","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityTracker.com Archives - Microsoft Internet Explorer Bugs Let Remote Users Modify Files or Execute Arbitrary Code","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33256","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33256","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/23772","name":"http://www.securityfocus.com/bid/23772","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"Microsoft Internet Explorer HTML Objects Script Errors Remote Code Execution Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-0947","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-0947","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2007","cve_id":"947","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":"internet_explorer","cpe6":"6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2007","cve_id":"947","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":"internet_explorer","cpe6":"7.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2007","cve_id":"947","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"microsoft","cpe5":"windows_2003_server","cpe6":"sp1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2007","cve_id":"947","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"microsoft","cpe5":"windows_2003_server","cpe6":"sp2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2007","cve_id":"947","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"microsoft","cpe5":"windows_vista","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2007","cve_id":"947","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"microsoft","cpe5":"windows_xp","cpe6":"*","cpe7":"sp2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T12:34:21.283Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"http://secunia.com/secunia_research/2007-36/advisory/"},{"name":"HPSBST02214","tags":["vendor-advisory","x_refsource_HP","x_transferred"],"url":"http://www.securityfocus.com/archive/1/468871/100/200/threaded"},{"name":"ADV-2007-1712","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2007/1712"},{"name":"1018019","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id?1018019"},{"name":"SSRT071422","tags":["vendor-advisory","x_refsource_HP","x_transferred"],"url":"http://www.securityfocus.com/archive/1/468871/100/200/threaded"},{"name":"oval:org.mitre.oval:def:2048","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2048"},{"name":"MS07-027","tags":["vendor-advisory","x_refsource_MS","x_transferred"],"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-027"},{"name":"23769","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/23769"},{"name":"23772","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/23772"},{"name":"34403","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/34403"},{"name":"TA07-128A","tags":["third-party-advisory","x_refsource_CERT","x_transferred"],"url":"http://www.us-cert.gov/cas/techalerts/TA07-128A.html"},{"name":"ie-html-memory-code-execution-variant(33256)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33256"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2007-05-08T00:00:00.000Z","descriptions":[{"lang":"en","value":"Use-after-free vulnerability in Microsoft Internet Explorer 7 on Windows XP SP2, Windows Server 2003 SP1 or SP2, or Windows Vista allows remote attackers to execute arbitrary code via crafted HTML objects, resulting in accessing deallocated memory of CMarkup objects, aka the second of two \"HTML Objects Memory Corruption Vulnerabilities\" and a different issue than CVE-2007-0946."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-16T14:57:01.000Z","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","shortName":"microsoft"},"references":[{"tags":["x_refsource_MISC"],"url":"http://secunia.com/secunia_research/2007-36/advisory/"},{"name":"HPSBST02214","tags":["vendor-advisory","x_refsource_HP"],"url":"http://www.securityfocus.com/archive/1/468871/100/200/threaded"},{"name":"ADV-2007-1712","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2007/1712"},{"name":"1018019","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id?1018019"},{"name":"SSRT071422","tags":["vendor-advisory","x_refsource_HP"],"url":"http://www.securityfocus.com/archive/1/468871/100/200/threaded"},{"name":"oval:org.mitre.oval:def:2048","tags":["vdb-entry","signature","x_refsource_OVAL"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2048"},{"name":"MS07-027","tags":["vendor-advisory","x_refsource_MS"],"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-027"},{"name":"23769","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/23769"},{"name":"23772","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/23772"},{"name":"34403","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/34403"},{"name":"TA07-128A","tags":["third-party-advisory","x_refsource_CERT"],"url":"http://www.us-cert.gov/cas/techalerts/TA07-128A.html"},{"name":"ie-html-memory-code-execution-variant(33256)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33256"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"secure@microsoft.com","ID":"CVE-2007-0947","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Use-after-free vulnerability in Microsoft Internet Explorer 7 on Windows XP SP2, Windows Server 2003 SP1 or SP2, or Windows Vista allows remote attackers to execute arbitrary code via crafted HTML objects, resulting in accessing deallocated memory of CMarkup objects, aka the second of two \"HTML Objects Memory Corruption Vulnerabilities\" and a different issue than CVE-2007-0946."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://secunia.com/secunia_research/2007-36/advisory/","refsource":"MISC","url":"http://secunia.com/secunia_research/2007-36/advisory/"},{"name":"HPSBST02214","refsource":"HP","url":"http://www.securityfocus.com/archive/1/468871/100/200/threaded"},{"name":"ADV-2007-1712","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2007/1712"},{"name":"1018019","refsource":"SECTRACK","url":"http://www.securitytracker.com/id?1018019"},{"name":"SSRT071422","refsource":"HP","url":"http://www.securityfocus.com/archive/1/468871/100/200/threaded"},{"name":"oval:org.mitre.oval:def:2048","refsource":"OVAL","url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2048"},{"name":"MS07-027","refsource":"MS","url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-027"},{"name":"23769","refsource":"SECUNIA","url":"http://secunia.com/advisories/23769"},{"name":"23772","refsource":"BID","url":"http://www.securityfocus.com/bid/23772"},{"name":"34403","refsource":"OSVDB","url":"http://www.osvdb.org/34403"},{"name":"TA07-128A","refsource":"CERT","url":"http://www.us-cert.gov/cas/techalerts/TA07-128A.html"},{"name":"ie-html-memory-code-execution-variant(33256)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33256"}]}}}},"cveMetadata":{"assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","assignerShortName":"microsoft","cveId":"CVE-2007-0947","datePublished":"2007-05-08T23:00:00.000Z","dateReserved":"2007-02-14T00:00:00.000Z","dateUpdated":"2024-08-07T12:34:21.283Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2007-05-08 23:19:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-399","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:C/I:C/A:C","baseScore":9.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.6,"impactScore":10,"acInsufInfo":false,"obtainAllPrivilege":true,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows_2003_server:sp1:*:*:*:*:*:*:*","matchCriteriaId":"644E2E89-F3E3-4383-B460-424D724EE62F"},{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows_2003_server:sp2:*:*:*:*:*:*:*","matchCriteriaId":"377F7D0C-6B44-4B90-BF90-DAF959880C6D"},{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:*","matchCriteriaId":"3852BB02-47A1-40B3-8E32-8D8891A53114"},{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*","matchCriteriaId":"9B339C33-8896-4896-88FF-88E74FDBC543"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:*","matchCriteriaId":"693D3C1C-E3E4-49DB-9A13-44ADDFF82507"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:internet_explorer:7.0:*:*:*:*:*:*:*","matchCriteriaId":"6BC71FD8-D385-4507-BD14-B75FDD4C79E6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows_2003_server:sp1:*:*:*:*:*:*:*","matchCriteriaId":"644E2E89-F3E3-4383-B460-424D724EE62F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:*","matchCriteriaId":"693D3C1C-E3E4-49DB-9A13-44ADDFF82507"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:internet_explorer:7.0:*:*:*:*:*:*:*","matchCriteriaId":"6BC71FD8-D385-4507-BD14-B75FDD4C79E6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows_2003_server:sp2:*:*:*:*:*:*:*","matchCriteriaId":"377F7D0C-6B44-4B90-BF90-DAF959880C6D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:*","matchCriteriaId":"693D3C1C-E3E4-49DB-9A13-44ADDFF82507"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:internet_explorer:7.0:*:*:*:*:*:*:*","matchCriteriaId":"6BC71FD8-D385-4507-BD14-B75FDD4C79E6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:*","matchCriteriaId":"3852BB02-47A1-40B3-8E32-8D8891A53114"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:internet_explorer:7.0:*:*:*:*:*:*:*","matchCriteriaId":"6BC71FD8-D385-4507-BD14-B75FDD4C79E6"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2007","CveId":"947","Ordinal":"1","Title":"CVE-2007-0947","CVE":"CVE-2007-0947","Year":"2007"},"notes":[{"CveYear":"2007","CveId":"947","Ordinal":"1","NoteData":"Use-after-free vulnerability in Microsoft Internet Explorer 7 on Windows XP SP2, Windows Server 2003 SP1 or SP2, or Windows Vista allows remote attackers to execute arbitrary code via crafted HTML objects, resulting in accessing deallocated memory of CMarkup objects, aka the second of two \"HTML Objects Memory Corruption Vulnerabilities\" and a different issue than CVE-2007-0946.","Type":"Description","Title":"CVE-2007-0947"},{"CveYear":"2007","CveId":"947","Ordinal":"2","NoteData":"2007-05-08","Type":"Other","Title":"Published"},{"CveYear":"2007","CveId":"947","Ordinal":"3","NoteData":"2018-10-16","Type":"Other","Title":"Modified"}]}}}