Vulnerability record · CVE-2007-2175 · published 24 April 2007
CVE-2007-2175: Apple QuickTime Java toQTPointer memory corruption allows code execution
Apple · Safari
The QuickTime Java extensions (QTJava.dll) expose the toQTPointer method in quicktime.util.QTHandleRef, which can be abused to modify arbitrary memory when QTPointerRef objects are created. Because this code runs inside browsers such as Safari when Java is enabled, a remote attacker can achieve arbitrary code execution. The flaw was publicly demonstrated at the CanSecWest 2007 PWN 2 0WN contest, so the technique is well known.
Description
Apple QuickTime Java extensions (QTJava.dll), as used in Safari and other browsers, and when Java is enabled, allows remote attackers to execute arbitrary code via parameters to the toQTPointer method in quicktime.util.QTHandleRef, which can be used to modify arbitrary memory when creating QTPointerRef objects, as demonstrated during the "PWN 2 0WN" contest at CanSecWest 2007.
AV:N/AC:H/Au:N/C:C/I:C/A:C
Automated analysis
high priorityCVSS 2.0 base score 7.6 (HIGH) with full C/I/A impact and a very high EPSS probability, though exploitation requires Java enabled and high access complexity.
What it is
The QuickTime Java extensions (QTJava.dll) expose the toQTPointer method in quicktime.util.QTHandleRef, which can be abused to modify arbitrary memory when QTPointerRef objects are created. Because this code runs inside browsers such as Safari when Java is enabled, a remote attacker can achieve arbitrary code execution. The flaw was publicly demonstrated at the CanSecWest 2007 PWN 2 0WN contest, so the technique is well known.
Impact
An attacker gains arbitrary code execution in the context of the browser or Java runtime, with full compromise of confidentiality, integrity and availability per the CVSS vector. This can lead to installation of malware or full control of the affected host.
Attack surface
Reached remotely over the network (AV:N) through a browser loading attacker-controlled content that invokes the QuickTime Java API; no authentication is required (Au:N). The CVSS vector rates access complexity as high (AC:H), and the description notes Java must be enabled, but no user interaction beyond visiting the page is described.
Exploitation
Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is very high at 0.838 (99.7th percentile) and the flaw was publicly demonstrated at CanSecWest 2007, indicating known exploit techniques exist.
What to do
- Apply the Apple security update referenced in Apple's May 2007 security announcement (docs.info.apple.com artnum 305446) or later QuickTime releases.
- Disable Java in browsers where QuickTime Java extensions are not required, or remove/disable the QTJava.dll component.
- Restrict or block untrusted web content that can invoke QuickTime Java APIs, and consider disabling QuickTime browser plug-ins on systems that do not need them.
- Where patching is not possible, isolate affected systems and limit browsing to trusted sites.
Detection
- Monitor browser and Java process crashes or abnormal memory access events associated with QTJava.dll or quicktime.util classes.
- Hunt for processes loading QTJava.dll alongside browser or Java runtime processes, especially from unexpected paths.
- Review proxy and web logs for known CanSecWest/PWN 2 0WN exploit pages or QuickTime Java test content reaching endpoints.
- Use endpoint detection to alert on code execution chains originating from browser plug-in or Java processes.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2007-2175 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2007-2175), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
