Vulnerability record · CVE-2007-4677 · published 7 November 2007
CVE-2007-4677: Apple QuickTime CTAB color table heap buffer overflow
Apple · Mac Os X
Apple QuickTime before 7.3 contains a heap-based buffer overflow triggered by an invalid color table size when parsing the color table atom (CTAB) in a movie file. Because the flaw is reachable through ordinary media parsing, it matters for any environment still running the affected QuickTime versions on macOS or Windows.
Description
Heap-based buffer overflow in Apple QuickTime before 7.3 allows remote attackers to execute arbitrary code via an invalid color table size when parsing the color table atom (CTAB) in a movie file, related to the CTAB RGB values.
AV:N/AC:M/Au:N/C:C/I:C/A:C
Automated analysis
high priorityThe flaw allows remote code execution with complete impact and has a very high EPSS score, though it is not in KEV and the affected software is long outdated.
What it is
Apple QuickTime before 7.3 contains a heap-based buffer overflow triggered by an invalid color table size when parsing the color table atom (CTAB) in a movie file. Because the flaw is reachable through ordinary media parsing, it matters for any environment still running the affected QuickTime versions on macOS or Windows.
Impact
A remote attacker can execute arbitrary code in the context of the user or process that opens the crafted movie file, giving full compromise of confidentiality, integrity and availability per the CVSS vector.
Attack surface
Reached remotely over the network by delivering a malicious movie file that the victim opens or previews; no authentication is required, but the CVSS vector rates access complexity as medium, implying some user interaction or a specific file-handling path.
Exploitation
Not listed in CISA KEV and no ransomware association is documented; EPSS is high at roughly 0.47 (98.8th percentile), and references are vendor and third-party advisories with no public exploit tag.
What to do
- Upgrade QuickTime to version 7.3 or later, or remove QuickTime from systems that no longer require it.
- Apply the vendor security update referenced in Apple advisory 306896 and the corresponding US-CERT alert TA07-310A.
- Block or strip untrusted movie files at email and web gateways, and disable automatic preview or thumbnail generation for media attachments.
- Restrict users from opening media files from untrusted sources and enforce least privilege so code execution does not run with elevated rights.
Detection
- Monitor for QuickTime or QuickTime-related processes spawning unexpected child processes or making outbound network connections after opening a media file.
- Alert on crashes or heap corruption events in QuickTime components tied to CTAB or color table parsing.
- Scan file shares, email attachments and download directories for movie files with malformed or oversized CTAB atoms.
- Review endpoint logs for exploitation attempts against hosts that still have QuickTime versions below 7.3 installed.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2007-4677 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2007-4677), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
