CVE-2007-2888: UltraISO .cue FILE string stack buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityPublic exploit code exists and EPSS is very high, but exploitation requires user interaction to open a crafted .cue file, limiting mass exploitation.

What it is

UltraISO 8.6.2.2011 and earlier contains a stack-based buffer overflow triggered by an overly long FILE string (filename) inside a .cue file. Opening a crafted cue file can corrupt the stack and allow arbitrary code execution in the context of the user running UltraISO.

Impact

An attacker who gets a victim to open a malicious .cue file can execute arbitrary code with the privileges of the UltraISO process, typically the logged-in user. This can lead to full compromise of the user's session and data.

Attack surface

The flaw is reached remotely via a crafted .cue file that the victim must open in UltraISO; the CVSS vector AV:N/AC:H/Au:N reflects network delivery of the file but no authentication and requires user interaction to open it. No server-side or unauthenticated network service is involved.

Exploitation

No CISA KEV listing, but public exploit references exist (Secunia advisory tagged Exploit, SecurityFocus BID 24140 tagged Exploit, Exploit-DB 3978) and EPSS is 0.54678 (98.9th percentile), indicating a high likelihood of exploitation activity.

What to do

• Upgrade UltraISO to a version later than 8.6.2.2011 if available from the vendor.
• Avoid opening .cue files from untrusted or unsolicited sources.
• Block or quarantine .cue email attachments and downloads at the gateway.
• Run UltraISO with least privilege and consider application sandboxing or AppLocker/WDAC restrictions.
• Monitor vendor advisories for a fixed release since the record does not name one.

Detection

• Search endpoint logs for UltraISO processes spawning child processes or making unexpected network connections after opening .cue files.
• Scan file shares and email gateways for .cue files containing unusually long FILE lines.
• Monitor for crash reports or access violations in UltraISO.exe correlated with .cue file opens.
• Use EDR to alert on stack-based exploitation indicators such as return-address corruption or shellcode-like memory writes in UltraISO.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.