Vulnerability record · CVE-2007-3034 · published 14 August 2007
CVE-2007-3034: Windows GDI metafile integer overflow enables remote code execution
Microsoft · Windows 2000
The AttemptWrite function in the Windows Graphics Rendering Engine (GDI) mishandles a large record length value in a crafted metafile, causing an integer overflow that leads to a heap-based buffer overflow. Because GDI processes metafiles during normal image rendering, a malicious file can corrupt memory and potentially run attacker code on affected Windows 2000, XP, and Server 2003 systems.
Description
Integer overflow in the AttemptWrite function in Graphics Rendering Engine (GDI) on Microsoft Windows 2000 SP4, XP SP2, and Server 2003 SP1 allows remote attackers to execute arbitrary code via a crafted metafile (image) with a large record length value, which triggers a heap-based buffer overflow.
AV:N/AC:M/Au:N/C:C/I:C/A:C
Automated analysis
high priorityRemote code execution with complete confidentiality, integrity, and availability impact, and a high EPSS score, though exploitation requires user interaction and the product set is legacy.
What it is
The AttemptWrite function in the Windows Graphics Rendering Engine (GDI) mishandles a large record length value in a crafted metafile, causing an integer overflow that leads to a heap-based buffer overflow. Because GDI processes metafiles during normal image rendering, a malicious file can corrupt memory and potentially run attacker code on affected Windows 2000, XP, and Server 2003 systems.
Impact
An attacker who gets a crafted metafile rendered can execute arbitrary code in the context of the process handling the image, giving full control of the affected system.
Attack surface
The flaw is reached remotely over the network when a user opens or previews a malicious metafile image, so it requires user interaction and no authentication. The CVSS vector AV:N/AC:M/Au:N confirms network reachability with medium complexity and no privileges.
Exploitation
The record is not listed in CISA KEV and no ransomware use is documented, but EPSS is high at roughly 0.52 (98.9th percentile), indicating elevated likelihood of exploitation activity. Reference tags show only vendor and government advisories plus a patch, with no public exploit tag.
What to do
- Apply Microsoft security bulletin MS07-046 (the vendor patch) to all affected Windows 2000 SP4, XP SP2, and Server 2003 SP1 systems.
- Block or strip untrusted metafile (WMF/EMF) images at email and web gateways where feasible.
- Disable or restrict automatic image preview and thumbnail generation for untrusted content.
- Run users with least privilege to limit the impact of successful code execution.
- Retire or isolate unsupported Windows 2000 and XP SP2 hosts that cannot be patched.
Detection
- Monitor for processes such as explorer.exe or image viewers spawning unexpected child processes after opening image files.
- Alert on crashes or heap corruption events in GDI-related modules (gdi32.dll) tied to image rendering.
- Hunt for suspicious metafile attachments or downloads with unusually large record length fields in email and proxy logs.
- Review endpoint logs for anomalous code execution originating from image preview or thumbnail handlers.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2007-3034 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2007-3034), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
