Vulnerability record

CVE-2007-0671

Microsoft Office Excel Remote Code Execution Vulnerability

HighExploitation confirmedCISA KEV

What should I do?

This vulnerability is in the CISA Known Exploited Vulnerabilities catalog: attackers are using it. If you run Office, fix it now.

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

US federal civilian agencies must remediate by Sep 2, 2025.

Patch status

No official fix confirmed yet

Until a fix ships, follow the vendor's mitigations and CISA's required action, limit exposure of affected systems, and watch this record for a patch.

Description

Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Office products, allows remote user-assisted attackers to execute arbitrary code via unknown attack vectors, as demonstrated by Exploit-MSExcel.h in targeted zero-day attacks.

Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.

Affected products

Products affected by this vulnerability, with versions and the source of each entry
Product	Vendor	Affected versions	Source
Excel	Microsoft	2000; 2002; 2003	NVD
Microsoft 365	Microsoft	2000; 2002; 2003	NVD
Office	Microsoft	2000; 2003; 2004; xp	KEV
PowerPoint	Microsoft	2000; 2002; 2003	NVD
Project	Microsoft	2000; 2002; 2003	NVD
Publisher	Microsoft	2000; 2002; 2003	NVD
Word	Microsoft	2000; 2002; 2003	NVD

Sources: NVD = NIST National Vulnerability Database; KEV = CISA Known Exploited Vulnerabilities catalog.

Intelligence timeline

Developments from the last 30 days, newest first.

CVSS scoredUpdateKEVSep 30, 2026
CVE-2007-0671 scored CVSS 8.8: Microsoft Office, Microsoft Office Excel Remote Code Execution Vulnerability
CISA lists this as exploited in the wild. Unpatched Office systems are exposed to active attacks now.
Basis: NIST National Vulnerability Database

1 earlier event is available with a subscription. See plans.

Coverage

We have not published a story about this vulnerability yet.

References

learn.microsoft.com https://learn.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-015
nvd.nist.gov https://nvd.nist.gov/vuln/detail/CVE-2007-0671
osvdb.org http://osvdb.org/31901
secunia.com http://secunia.com/advisories/24008
securitytracker.com http://securitytracker.com/id?1017584
vil.nai.com http://vil.nai.com/vil/content/v_141393.htm
avertlabs.com http://www.avertlabs.com/research/blog/?p=191
kb.cert.org http://www.kb.cert.org/vuls/id/613740
microsoft.com http://www.microsoft.com/technet/security/advisory/932553.mspx
securityfocus.com http://www.securityfocus.com/bid/22383
us-cert.gov http://www.us-cert.gov/cas/techalerts/TA07-044A.html
vupen.com http://www.vupen.com/english/advisories/2007/0463
docs.microsoft.com https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-015
exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/32178
oval.cisecurity.org https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A301
cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2007-0671