How severe is CVE-2007-2931?

CVE-2007-2931 has a CVSS 2.0 base score of 9.3, rated critical severity.

Is CVE-2007-2931 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 55% (99th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2007-2931?

CVE-2007-2931 primarily affects Microsoft Msn Messenger. In total, 4 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2007-2931?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2007-2931 published?

CVE-2007-2931 was published on 2007-08-31 and last updated on 2026-06-16.

CVE-2007-2931

CVE-2007-2931 is a critical-severity vulnerability in Microsoft Msn Messenger with a CVSS 2.0 base score of 9.3. Its EPSS exploit-prediction score of 55% places it in the 99th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-20.

Key facts

Severity: Critical (CVSS 2.0 base score 9.3)
EPSS exploit prediction: 55% (99th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-20
Affected product: Microsoft Msn Messenger
Published: 2007-08-31
Last modified: 2026-06-16

Description

Heap-based buffer overflow in Microsoft MSN Messenger 6.2, 7.0, and 7.5, and Live Messenger 8.0 allows user-assisted remote attackers to execute arbitrary code via unspecified vectors involving video conversation handling in Web Cam and video chat sessions.

Frequently asked questions

What is CVE-2007-2931?: Heap-based buffer overflow in Microsoft MSN Messenger 6.2, 7.0, and 7.5, and Live Messenger 8.0 allows user-assisted remote attackers to execute arbitrary code via unspecified vectors involving video conversation handling in Web Cam and video chat sessions.
How severe is CVE-2007-2931?: CVE-2007-2931 has a CVSS 2.0 base score of 9.3, rated critical severity.
Is CVE-2007-2931 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 55% (99th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2007-2931?: CVE-2007-2931 primarily affects Microsoft Msn Messenger. In total, 4 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2007-2931?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2007-2931 published?: CVE-2007-2931 was published on 2007-08-31 and last updated on 2026-06-16.

References

Affected products (4)

cpe:2.3:a:microsoft:msn_messenger:6.2:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:msn_messenger:7.0:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:msn_messenger:7.5:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:windows_live_messenger:8.0:*:*:*:*:*:*:*

More vulnerabilities in Microsoft Msn Messenger

CVE-2004-0597 — Critical (CVSS 10.0): Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute…
CVE-2005-0562 — High (CVSS 7.5): GIF file validation error in MSN Messenger 6.2 allows remote attackers in a user's contact list to execute arbitrary…
CVE-2002-0155 — High (CVSS 7.5): Buffer overflow in Microsoft MSN Chat ActiveX Control, as used in MSN Messenger 4.5 and 4.6, and Exchange Instant…
CVE-2007-3436 — Medium (CVSS 5.0): Microsoft MSN Messenger 4.7 on Windows XP allows remote attackers to cause a denial of service (resource consumption)…
CVE-2004-0122 — Medium (CVSS 5.0): Microsoft MSN Messenger 6.0 and 6.1 does not properly handle certain requests, which allows remote attackers to read…
CVE-2002-1698 — Medium (CVSS 5.0): Buffer overflow in Microsoft MSN Messenger Service 1.0 through 4.6 allows remote attackers to cause a denial of service…

All CVEs affecting Microsoft Msn Messenger →

Other CWE-20 (Improper Input Validation) vulnerabilities

CVE-2026-48316 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
CVE-2026-48281 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
CVE-2026-48277 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
CVE-2026-48055 — Critical (CVSS 10.0): Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and…
CVE-2026-34910 — Critical (CVSS 10.0): A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS…
CVE-2026-33587 — Critical (CVSS 10.0): Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and…

Browse all CWE-20 (Improper Input Validation) vulnerabilities →