How severe is CVE-2007-0463?

CVE-2007-0463 has a CVSS 2.0 base score of 5.0, rated medium severity.

Is CVE-2007-0463 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 18% (97th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2007-0463?

CVE-2007-0463 affects Apple Software Update. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2007-0463?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2007-0463 published?

CVE-2007-0463 was published on 2007-01-29 and last updated on 2026-06-16.

CVE-2007-0463

CVE-2007-0463 is a medium-severity vulnerability in Apple Software Update with a CVSS 2.0 base score of 5.0. Its EPSS exploit-prediction score of 18% places it in the 97th percentile, indicating an elevated likelihood of exploitation.

Key facts

Severity: Medium (CVSS 2.0 base score 5.0)
EPSS exploit prediction: 18% (97th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Apple Software Update
Published: 2007-01-29
Last modified: 2026-06-16

Description

Format string vulnerability in Apple Software Update 2.0.5 on Mac OS X 10.4.8 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via format string specifiers in (1) SWUTMP or (2) SUCATALOG filenames, or using the (3) application/x-apple.sucatalog+xml MIME type.

Frequently asked questions

What is CVE-2007-0463?: Format string vulnerability in Apple Software Update 2.0.5 on Mac OS X 10.4.8 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via format string specifiers in (1) SWUTMP or (2) SUCATALOG filenames, or using the (3) application/x-apple.sucatalog+xml MIME type.
How severe is CVE-2007-0463?: CVE-2007-0463 has a CVSS 2.0 base score of 5.0, rated medium severity.
Is CVE-2007-0463 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 18% (97th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2007-0463?: CVE-2007-0463 affects Apple Software Update. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2007-0463?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2007-0463 published?: CVE-2007-0463 was published on 2007-01-29 and last updated on 2026-06-16.

References

Affected products (1)

cpe:2.3:a:apple:software_update:2.0.5:*:*:*:*:*:*:*

More vulnerabilities in Apple Software Update

CVE-2016-1731 — Medium (CVSS 5.9): Apple Software Update before 2.2 on Windows does not use HTTPS, which makes it easier for man-in-the-middle attackers…

All CVEs affecting Apple Software Update →