CVE-2007-4776: Microsoft Visual Basic 6.0 VBP File Buffer Overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCVSS 2.0 base score is 9.3 and public exploit code exists, but exploitation requires user interaction and the record notes limited usage scenarios, keeping it below critical.

What it is

Microsoft Visual Basic 6.0 and Enterprise Edition 6.0 SP6 contain a buffer overflow triggered when opening a Visual Basic project (.vbp) file with an overly long Reference line, related to VBP_Open and OLE. The flaw matters because successful exploitation can lead to arbitrary code execution, though the record notes limited usage scenarios under which this would be a vulnerability.

Impact

An attacker who convinces a user to open a crafted .vbp file can execute arbitrary code in the context of that user. This gives full compromise of confidentiality, integrity, and availability on the affected host.

Attack surface

The vector is network-reachable (AV:N) but requires medium complexity (AC:M) and no authentication (Au:N), with user interaction implied by the user-assisted nature of opening a project file. The attacker must deliver a malicious .vbp file and get the victim to open it in Visual Basic 6.0.

Exploitation

CISA KEV does not list this CVE, but public exploit code exists on Exploit-DB (4361, 4431) and EPSS is high at 0.48964 (98.8th percentile), indicating meaningful exploitation likelihood.

What to do

• Apply the Microsoft patch for Visual Basic 6.0 if still supported; if no patch is available, treat the product as end-of-life and plan migration.
• Block or restrict opening of untrusted .vbp files, especially from email, downloads, or shared drives.
• Enforce email and web gateway filtering for .vbp attachments and file types associated with Visual Basic projects.
• Run Visual Basic 6.0 under a least-privilege account and consider application allowlisting to limit code execution impact.
• Educate users not to open Visual Basic project files from unknown or untrusted sources.

Detection

• Monitor for processes opening .vbp files from external or untrusted locations, especially via email clients or browsers.
• Hunt for Visual Basic 6.0 (vb6.exe) spawning child processes such as cmd.exe, powershell.exe, or scripting hosts.
• Inspect file creation and execution events for .vbp files with unusually long Reference lines or embedded OLE objects.
• Review endpoint logs for crashes or exceptions in VB6.exe correlated with file-open events.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.