CVE-2007-2238: Microsoft IAG Whale Client ActiveX control stack buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityRemote code execution with a 9.3 CVSS and very high EPSS, tempered by the need for user interaction and a browser that runs the ActiveX control.

What it is

The Whale Client Components ActiveX control (WhlMgr.dll) shipped with Microsoft Intelligent Application Gateway (IAG) before 3.7 SP2 contains multiple stack-based buffer overflows in its CheckForUpdates and UpdateComponents methods. Passing overly long arguments to these methods corrupts the stack, letting an attacker run arbitrary code in the context of the browser process that loaded the control. The flaw matters because the control is reachable from web content and the affected product is a remote-access gateway.

Impact

An attacker who can get the vulnerable ActiveX control instantiated gains arbitrary code execution with the privileges of the user running the browser, which on a gateway or admin workstation can mean full control of that host.

Attack surface

Reached over the network by a page that instantiates the WhlMgr.dll ActiveX control and calls CheckForUpdates or UpdateComponents with long arguments; no authentication is required, but the victim must load the attacker's content in a browser that permits the control to run, so user interaction is needed.

Exploitation

Not listed in CISA KEV and no public exploit or ransomware use is recorded in this data, but EPSS is 0.455 (98.7th percentile), indicating a high modeled likelihood of exploitation activity.

What to do

• Apply the IAG 3.7 SP2 or later update that fixes WhlMgr.dll, and confirm the patched control version is deployed.
• Remove or kill-bit the Whale Client Components ActiveX control where IAG client components are not required.
• Restrict browsing from IAG gateway and administrative hosts, and block untrusted sites from loading ActiveX controls.
• Enforce least privilege so browser processes cannot execute code with elevated rights.

Detection

• Monitor for WhlMgr.dll being loaded by browser processes and for calls to CheckForUpdates or UpdateComponents.
• Alert on browser or child process crashes consistent with stack corruption on hosts that use IAG client components.
• Hunt for unexpected child processes spawned by browsers on IAG gateway or admin systems.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.