{"cve":"CVE-2007-1765","nvd":{"published":"2007-03-30T00:19:00.000","modified":"2026-06-16T22:38:15.003","status":"Modified","description":"Unspecified vulnerability in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code or cause a denial of service (persistent reboot) via a malformed ANI file, which results in memory corruption when processing cursors, animated cursors, and icons, a similar issue to CVE-2005-0416, as originally demonstrated using Internet Explorer 6 and 7.  NOTE: this issue might be a duplicate of CVE-2007-0038; if so, then use CVE-2007-0038 instead of this identifier.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["http://asert.arbornetworks.com/2007/03/any-ani-file-could-infect-you/","http://research.eeye.com/html/alerts/zeroday/20070328.html","http://vil.nai.com/vil/content/v_141860.htm","http://www.avertlabs.com/research/blog/?p=230","http://www.avertlabs.com/research/blog/?p=233"],"products":["avaya:definity_one_media_server","avaya:ip600_media_servers","avaya:s3400","avaya:s8100","microsoft:ie","microsoft:internet_explorer","microsoft:windows_2000","microsoft:windows_2003_server","microsoft:windows_vista","microsoft:windows_xp"],"source":"nvd","synced_at":"2026-10-19T19:44:49.019236172+00:00"},"epss":{"cve":"CVE-2007-1765","score":0.54853,"percentile":0.99024,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}