Vulnerability record · CVE-2007-2386 · published 24 May 2007
CVE-2007-2386: Apple Mac OS X mDNSResponder UPnP IGD buffer overflow
Apple · Mac Os X
mDNSResponder in Apple Mac OS X 10.4 through 10.4.9 contains a buffer overflow reachable through a crafted UPnP Internet Gateway Device packet. A remote attacker can terminate the service or execute arbitrary code, and the flaw carries a CVSS 2.0 score of 9.4. The record does not name the exact vulnerable function or the packet field that overflows.
Description
Buffer overflow in mDNSResponder in Apple Mac OS X 10.4 up to 10.4.9 allows remote attackers to cause a denial of service (application termination) or execute arbitrary code via a crafted UPnP Internet Gateway Device (IGD) packet.
AV:N/AC:L/Au:N/C:C/I:N/A:C
Automated analysis
high priorityThe flaw is remotely exploitable without authentication and can lead to code execution, but it affects only legacy Mac OS X 10.4 systems and no KEV listing or confirmed exploit reference is present.
What it is
mDNSResponder in Apple Mac OS X 10.4 through 10.4.9 contains a buffer overflow reachable through a crafted UPnP Internet Gateway Device packet. A remote attacker can terminate the service or execute arbitrary code, and the flaw carries a CVSS 2.0 score of 9.4. The record does not name the exact vulnerable function or the packet field that overflows.
Impact
An unauthenticated remote attacker can crash mDNSResponder, causing denial of service, or potentially run arbitrary code in the affected process. The CVSS vector shows full confidentiality and availability impact with no integrity impact.
Attack surface
The flaw is network-reachable (AV:N) with no authentication (Au:N) and low attack complexity (AC:L), triggered by a crafted UPnP IGD packet. No user interaction is indicated by the vector or description.
Exploitation
CISA KEV does not list this CVE, but EPSS is high at roughly 0.50 (98.8th percentile), suggesting meaningful exploitation likelihood. No reference is tagged as an exploit, so public exploit code is not confirmed by this record.
What to do
- Apply the Apple security updates referenced in the Apple security-announce advisories for Mac OS X 10.4.
- Upgrade from Mac OS X 10.4.x to a supported, patched release if the system is still in service.
- Block or restrict inbound UPnP/SSDP traffic to affected hosts at the network boundary where UPnP is not required.
- Disable UPnP Internet Gateway Device functionality on hosts and gateways that do not need it.
- Isolate legacy Mac OS X 10.4 systems on segmented networks with no exposure to untrusted networks.
Detection
- Monitor for mDNSResponder process crashes or unexpected restarts on Mac OS X 10.4 hosts.
- Inspect network traffic for malformed or oversized UPnP IGD packets directed at affected hosts.
- Alert on unexpected outbound connections or child processes spawned by mDNSResponder.
- Review system logs around mDNSResponder termination events for correlated anomalous network activity.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2007-2386 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2007-2386), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
