CVE-2007-0671

Microsoft Office Excel Remote Code Execution

8.8 HIGHActively exploited (CISA KEV)EPSS 43.2%

Published3 Feb 2007
Added to CISA KEV12 Aug 2025
Remediation due2 Sept 2025

Microsoft Office Excel contains a remote code execution vulnerability that can be exploited when a specially crafted Excel file is opened. This malicious file could be delivered as an email attachment or hosted on a malicious website. An attacker could leverage this vulnerability by creating a specially crafted Excel file, which, when opened, allowing an attacker to execute remote code on the affected system.

Added to KEV: 12 Aug 2025Federal remediation due: 2 Sept 2025

Description

Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Office products, allows remote user-assisted attackers to execute arbitrary code via unknown attack vectors, as demonstrated by Exploit-MSExcel.h in targeted zero-day attacks.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionRequired

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Microsoft Access2000 · 2002 · 2003

Microsoft Excel2000 · 2002 · 2003

Microsoft Excel Viewer2003

Microsoft Frontpage2000 · 2002 · 2003

Microsoft Infopath2003

Microsoft Office2000 · 2003 · 2004 · xp

Microsoft Onenote2003

Microsoft Outlook2000 · 2002 · 2003

Microsoft Powerpoint2000 · 2002 · 2003

Microsoft Project2000 · 2002 · 2003

Microsoft Publisher2000 · 2002 · 2003

Microsoft Visio2002 · 2003

Microsoft Word2000 · 2002 · 2003

Microsoft Word Viewer2003

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

Patch & vendor advisories

References

http://osvdb.org/31901Broken Link
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-015Vendor Advisory
http://secunia.com/advisories/24008Vendor AdvisoryBroken Link
http://securitytracker.com/id?1017584Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/32178Third Party Advisory
https://learn.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-015Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A301Broken Link
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2007-0671US Government Resource
http://vil.nai.com/vil/content/v_141393.htmBroken Link
http://www.avertlabs.com/research/blog/?p=191Broken Link

and 5 more references

Frequently asked

Is CVE-2007-0671 being actively exploited?

Yes. CVE-2007-0671 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 12 Aug 2025.

How severe is CVE-2007-0671?

CVE-2007-0671 has a CVSS 3.1 base score of 8.8, rated high. EPSS estimates a 43.2% probability of exploitation.

Which products are affected by CVE-2007-0671?

Affected products include Microsoft Access, Microsoft Excel, Microsoft Excel Viewer, Microsoft Frontpage, Microsoft Infopath, and 9 more.

How do I fix CVE-2007-0671?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2007-0671 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Running Microsoft 365?

Patching is one half. Scan your domain and check MFA, legacy authentication, admin roles and mail forwarding in two minutes, with a fix for every gap.

Run the free Microsoft 365 check

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.