CVE-2007-0671Microsoft Office Excel Remote Code Execution Vulnerability

BOD 26-04 remediation window

With CISA's SSVC answers for this CVE (automatable: no, technical impact: total), BOD 26-04 Table 1 gives 3 days and forensic triage on a publicly exposed asset (row 3) and 14 days on an asset that is not publicly exposed (row 11) ^S06. The catalogue due date, 21 days after the date added, was set before BOD 26-04 took effect on 10 June 2026 ^S06. The directive binds US federal civilian executive branch agencies only.

What CISA says

Short description

Microsoft Office Excel contains a remote code execution vulnerability that can be exploited when a specially crafted Excel file is opened. This malicious file could be delivered as an email attachment or hosted on a malicious website. An attacker could leverage this vulnerability by creating a specially crafted Excel file, which, when opened, allowing an attacker to execute remote code on the affected system.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes

https://learn.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-015 ; https://nvd.nist.gov/vuln/detail/CVE-2007-0671

CWE in the catalogue

Not provided by source

Official links

• CISA KEV catalogue entry cisa.gov
• NVD record nvd.nist.gov

Vendor advisory and patch links

References NVD tags Vendor Advisory or Patch, exactly as NVD lists them.

• http://secunia.com/advisories/24008 Broken Link, Vendor Advisory; NVD marks this link broken
• http://www.microsoft.com/technet/security/advisory/932553.mspx Broken Link, Vendor Advisory; NVD marks this link broken
• http://www.vupen.com/english/advisories/2007/0463 Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-015 Vendor Advisory
• https://learn.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-015 Vendor Advisory

Links in CISA's notes

• https://learn.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-015
• https://nvd.nist.gov/vuln/detail/CVE-2007-0671

NVD details

CWE (NVD)

NVD-CWE-noinfo by nvd@nist.gov

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS versions in NVD

V2, V31

Last modified in NVD

2026-06-16T22:36:02.527

Where each value comes from

This product uses data from the NVD API but is not endorsed or certified by the NVD. CISA does not endorse Sysprobs. Methodology.