CVE-2007-1765

CVE-2007-1765 is a critical-severity vulnerability in Avaya Ip600 Media Servers with a CVSS 2.0 base score of 9.3. Its EPSS exploit-prediction score of 54% places it in the 99th percentile, indicating an elevated likelihood of exploitation.

Key facts

• Severity: Critical (CVSS 2.0 base score 9.3)
• EPSS exploit prediction: 54% (99th percentile)
• Actively exploited: Not listed in CISA KEV
• Affected product: Avaya Ip600 Media Servers
• Published: 2007-03-30
• Last modified: 2026-06-16

Description

Unspecified vulnerability in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code or cause a denial of service (persistent reboot) via a malformed ANI file, which results in memory corruption when processing cursors, animated cursors, and icons, a similar issue to CVE-2005-0416, as originally demonstrated using Internet Explorer 6 and 7. NOTE: this issue might be a duplicate of CVE-2007-0038; if so, then use CVE-2007-0038 instead of this identifier.

Frequently asked questions

What is CVE-2007-1765?

Unspecified vulnerability in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code or cause a denial of service (persistent reboot) via a malformed ANI file, which results in memory corruption when processing cursors, animated cursors, and icons, a similar issue to CVE-2005-0416, as originally demonstrated using Internet Explorer 6 and 7. NOTE: this issue might be a duplicate of CVE-2007-0038; if so, then use CVE-2007-0038 instead of this identifier.

How severe is CVE-2007-1765?

CVE-2007-1765 has a CVSS 2.0 base score of 9.3, rated critical severity.

Is CVE-2007-1765 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 54% (99th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2007-1765?

CVE-2007-1765 primarily affects Avaya Ip600 Media Servers. In total, 43 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2007-1765?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2007-1765 published?

CVE-2007-1765 was published on 2007-03-30 and last updated on 2026-06-16.

References

• http://asert.arbornetworks.com/2007/03/any-ani-file-could-infect-you/
• http://research.eeye.com/html/alerts/zeroday/20070328.html
• http://vil.nai.com/vil/content/v_141860.htm
• http://www.avertlabs.com/research/blog/?p=230
• http://www.avertlabs.com/research/blog/?p=233
• http://www.microsoft.com/technet/security/advisory/935423.mspx
• http://www.securityfocus.com/archive/1/464287/100/0/threaded
• http://www.securityfocus.com/archive/1/464345/100/0/threaded
• http://www.securityfocus.com/bid/23194
• http://www.securitytracker.com/id?1017827
• http://www.vupen.com/english/advisories/2007/1151

Affected products (43)

• cpe:2.3:o:microsoft:windows_2000:*:*:*:*:advanced_server:*:*:*
• cpe:2.3:o:microsoft:windows_2000:*:*:*:*:datacenter_server:*:*:*
• cpe:2.3:o:microsoft:windows_2000:*:*:*:*:professional:*:*:*
• cpe:2.3:o:microsoft:windows_2000:*:*:*:ja:server:*:*:*
• cpe:2.3:o:microsoft:windows_2000:*:sp1:*:*:advanced_server:*:*:*
• cpe:2.3:o:microsoft:windows_2000:*:sp1:*:*:datacenter_server:*:*:*
• cpe:2.3:o:microsoft:windows_2000:*:sp1:*:*:professional:*:*:*
• cpe:2.3:o:microsoft:windows_2000:*:sp1:*:*:server:*:*:*
• cpe:2.3:o:microsoft:windows_2000:*:sp2:*:*:advanced_server:*:*:*
• cpe:2.3:o:microsoft:windows_2000:*:sp2:*:*:datacenter_server:*:*:*
• cpe:2.3:o:microsoft:windows_2000:*:sp2:*:*:server:*:*:*
• cpe:2.3:o:microsoft:windows_2000:*:sp3:*:*:advanced_server:*:*:*
• cpe:2.3:o:microsoft:windows_2000:*:sp3:*:*:datacenter_server:*:*:*
• cpe:2.3:o:microsoft:windows_2000:*:sp3:*:*:professional:*:*:*
• cpe:2.3:o:microsoft:windows_2000:*:sp3:*:*:server:*:*:*
• cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:advanced_server:*:*:*
• cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:datacenter_server:*:*:*
• cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:professional:*:*:*
• cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:server:*:*:*
• cpe:2.3:o:microsoft:windows_2000:-:sp2:*:*:professional:*:*:*
• cpe:2.3:o:microsoft:windows_2003_server:-:*:*:*:datacenter:*:*:*
• cpe:2.3:o:microsoft:windows_2003_server:-:*:*:*:enterprise:*:*:*
• cpe:2.3:o:microsoft:windows_2003_server:-:*:*:*:standard:*:*:*
• cpe:2.3:o:microsoft:windows_2003_server:-:*:*:*:web_edition:*:*:*
• cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:x86:*
• cpe:2.3:o:microsoft:windows_vista:*:*:*:*:business:*:*:*
• cpe:2.3:o:microsoft:windows_vista:*:*:*:*:december_ctp:*:*:*
• cpe:2.3:o:microsoft:windows_vista:*:*:*:*:enterprise:*:*:*
• cpe:2.3:o:microsoft:windows_vista:*:*:*:*:home_basic:*:*:*
• cpe:2.3:o:microsoft:windows_vista:*:*:*:*:home_premium:*:*:*
• cpe:2.3:o:microsoft:windows_vista:*:beta:*:*:*:*:*:*
• cpe:2.3:o:microsoft:windows_vista:*:beta1:*:*:*:*:*:*
• cpe:2.3:o:microsoft:windows_vista:*:beta2:*:*:*:*:*:*
• cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:home:*:*:*
• cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:media_center:*:*:*
• cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:professional:*:*:*
• cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:tablet_pc:*:*:*
• cpe:2.3:a:avaya:ip600_media_servers:*:*:*:*:*:*:*:*
• cpe:2.3:a:microsoft:ie:7.0:*:vista:*:*:*:*:*
• cpe:2.3:a:microsoft:internet_explorer:*:*:*:*:*:*:*:*

More vulnerabilities in Avaya Ip600 Media Servers

• CVE-2004-1050 — Critical (CVSS 10.0): Heap-based buffer overflow in Internet Explorer 6 allows remote attackers to execute arbitrary code via long (1) SRC or…
• CVE-2004-0212 — Critical (CVSS 10.0): Stack-based buffer overflow in the Task Scheduler for Windows 2000 and XP, and Internet Explorer 6 on Windows NT 4.0,…
• CVE-2004-0201 — Critical (CVSS 10.0): Heap-based buffer overflow in the HtmlHelp program (hh.exe) in HTML Help for Microsoft Windows 98, Me, NT 4.0, 2000,…
• CVE-2004-0842 — High (CVSS 7.5): Internet Explorer 6.0 SP1 and earlier, and possibly other versions, allows remote attackers to cause a denial of…
• CVE-2004-0205 — High (CVSS 7.2): Buffer overflow in Microsoft Internet Information Server (IIS) 4.0 allows local users to execute arbitrary code via the…
• CVE-2004-0841 — Medium (CVSS 5.0): Internet Explorer 6.x allows remote attackers to install arbitrary programs via mousedown events that call the…

All CVEs affecting Avaya Ip600 Media Servers →