CVE-2007-0038: Microsoft Windows ANI cursor parsing stack buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityRemote code execution with complete impact and a very high EPSS score, though the flaw is old and a patch has long existed.

What it is

The animated cursor code in Windows 2000 SP4 through Vista contains a stack-based buffer overflow triggered by a large length value in the second or later anih block of a RIFF .ANI, .cur, or .ico file. Processing such a cursor, animated cursor, or icon corrupts memory, allowing remote code execution or a persistent reboot denial of service. It is a variant of CVE-2005-0416 and may duplicate CVE-2007-1765.

Impact

An attacker can execute arbitrary code in the context of the affected process or crash the system into a persistent reboot loop. Successful exploitation gives full control of confidentiality, integrity, and availability per the CVSS vector.

Attack surface

Reached remotely over the network by delivering a crafted cursor or icon file, originally demonstrated through Internet Explorer 6 and 7. No authentication is required, but the CVSS vector indicates medium attack complexity, implying some precondition such as user interaction to open or render the file.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is very high at 0.7288 (99.4th percentile), and references include vendor advisories and US-CERT alerts consistent with active exploitation at disclosure.

What to do

• Apply Microsoft security bulletin MS07-017 for the affected Windows versions.
• Upgrade or retire Windows 2000, XP, and Server 2003 systems that no longer receive security updates.
• Block or strip .ANI, .CUR, and .ICO attachments and downloads at mail and web gateways where feasible.
• Disable or restrict rendering of animated cursors and icons in browsers and document viewers.
• Monitor for unexpected reboots or crashes on unpatched endpoints as a possible exploitation indicator.

Detection

• Hunt for processes loading or rendering .ANI, .CUR, or .ICO files from email, web, or temp directories.
• Alert on repeated unexpected system reboots or crashes on unpatched Windows hosts.
• Inspect network and proxy logs for delivery of cursor or icon files from untrusted sources.
• Check endpoint patch state against MS07-017 to identify exposed systems.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.