CVE-2007-0948
CVE-2007-0948 is a critical-severity vulnerability in Microsoft Virtual Pc with a CVSS 2.0 base score of 9.3. Its EPSS exploit-prediction score of 12% places it in the 96th percentile, indicating an elevated likelihood of exploitation.
Key facts
- Severity: Critical (CVSS 2.0 base score 9.3)
- EPSS exploit prediction: 12% (96th percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Microsoft Virtual Pc
- Published:
- Last modified:
Description
Heap-based buffer overflow in Microsoft Virtual PC 2004 and PC for Mac 7.1 and 7, and Virtual Server 2005 and 2005 R2, allows local guest OS administrators to execute arbitrary code on the host OS via unspecified vectors related to "interaction and initialization of components."
Frequently asked questions
- What is CVE-2007-0948?
- Heap-based buffer overflow in Microsoft Virtual PC 2004 and PC for Mac 7.1 and 7, and Virtual Server 2005 and 2005 R2, allows local guest OS administrators to execute arbitrary code on the host OS via unspecified vectors related to "interaction and initialization of components."
- How severe is CVE-2007-0948?
- CVE-2007-0948 has a CVSS 2.0 base score of 9.3, rated critical severity.
- Is CVE-2007-0948 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 12% (96th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2007-0948?
- CVE-2007-0948 primarily affects Microsoft Virtual Pc. In total, 5 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2007-0948?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
- When was CVE-2007-0948 published?
- CVE-2007-0948 was published on 2007-08-14 and last updated on 2026-06-16.
References
- http://secunia.com/advisories/26444
- http://www.securityfocus.com/bid/25298
- http://www.securitytracker.com/id?1018567
- http://www.us-cert.gov/cas/techalerts/TA07-226A.html
- http://www.vupen.com/english/advisories/2007/2873
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-049
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1259
Affected products (5)
- cpe:2.3:a:microsoft:virtual_pc:6.1:*:mac:*:*:*:*:*
- cpe:2.3:a:microsoft:virtual_pc:7:*:mac:*:*:*:*:*
- cpe:2.3:a:microsoft:virtual_pc:2004:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:virtual_server:2005:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:virtual_server:2005:r2:*:*:*:*:*:*
More vulnerabilities in Microsoft Virtual Pc
- CVE-2010-1225 — Critical (CVSS 9.3): The memory-management implementation in the Virtual Machine Monitor (aka VMM or hypervisor) in Microsoft Virtual PC…
- CVE-2009-1542 — Critical (CVSS 9.0): The Virtual Machine Monitor (VMM) in Microsoft Virtual PC 2004 SP1, 2007, and 2007 SP1, and Microsoft Virtual Server…
- CVE-2004-0115 — Medium (CVSS 4.6): VirtualPC_Services in Microsoft Virtual PC for Mac 6.0 through 6.1 allows local attackers to truncate and overwrite…