Unscored severity · published Jul 10, 2007
CVE-2007-1754
PUBCONV.DLL in Microsoft Office Publisher 2007 does not properly clear memory when transferring data from disk to memory, which allows user-assisted remote attackers to execute…
–
CVSS
32.8%
EPSS
No
On KEV
Description
PUBCONV.DLL in Microsoft Office Publisher 2007 does not properly clear memory when transferring data from disk to memory, which allows user-assisted remote attackers to execute arbitrary code via a malformed .pub page via a certain negative value, which bypasses a sanitization procedure that initializes critical pointers to NULL, aka the "Publisher Invalid Memory Reference Vulnerability".
Exploitation
Is it being used?
Exploit prediction (EPSS)32.8% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PU
Publisher · Microsoft
2007 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-1754
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-1754
archive.cert.uni-stuttgart.de
http://archive.cert.uni-stuttgart.de/bugtraq/2007/07/msg00254.html
osvdb.org
http://osvdb.org/35953
research.eeye.com
http://research.eeye.com/html/advisories/published/AD20070710.html
Vendor Advisory
http://secunia.com/advisories/25988
www.securityfocus.com
http://www.securityfocus.com/archive/1/473309/100/0/threaded
www.securitytracker.com
http://www.securitytracker.com/id?1018353
More from Publisher
8.8
CVE-2007-0671
Microsoft Office Excel Remote Code Execution Vulnerability
7.3
CVE-2024-38226
Microsoft Publisher Security Feature Bypass Vulnerability
8.8
CVE-2026-81385
Microsoft Office Publisher Remote Code Execution Vulnerability
8.8
CVE-2026-69742
Microsoft Office Publisher Remote Code Execution Vulnerability
8.8
CVE-2020-0760
A remote code execution vulnerability exists when Microsoft Office improperly loads arbitrary type libraries, aka 'Microsoft Office Remote Code Execution Vulnerability'