CVE-2007-6016: Symantec Backup Exec ActiveX Control Stack Buffer Overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityRemote code execution with complete impact and a public exploit, but exploitation requires a victim to load the control and the product is a legacy server component, so it is high rather than critical.

What it is

The PVATLCalendar.PVCalendar.1 ActiveX control (pvcalendar.ocx) in the scheduler component of Symantec Backup Exec for Windows Server contains multiple stack-based buffer overflows. Long values passed to _DOWText0-6 or _MonthText0-11 properties when the Save method executes overwrite the stack, allowing remote code execution. The flaw matters because the control is reachable from a web page, so a victim only needs to load a malicious page in a browser with the control installed.

Impact

An attacker can execute arbitrary code in the context of the user or process that loads the control, giving full control of the affected machine. Because the CVSS vector shows complete confidentiality, integrity and availability impact, a successful exploit can lead to total host compromise.

Attack surface

Reached over the network (AV:N) by a client loading the ActiveX control, typically through a malicious web page or document; no authentication is required on the attacking side, though the CVSS vector notes medium attack complexity (AC:M). The vendor states authenticated user involvement is required, but authentication is not needed to attack a client machine that loads the control.

Exploitation

The record is not listed in CISA KEV and no ransomware associations are documented, but EPSS is high at 0.504 (98.9th percentile) and a public Exploit-DB entry (5205) exists, indicating exploit code is available.

What to do

• Apply the Symantec/Veritas patch referenced in the vendor advisories and SecurityFocus BID 26904.
• If patching is not immediately possible, disable or kill-bit the PVATLCalendar.PVCalendar.1 ActiveX control in Internet Explorer and other browsers that load it.
• Restrict or block outbound browsing from Backup Exec servers and other hosts with the control installed.
• Remove or unregister pvcalendar.ocx on systems that do not require the scheduler component.
• Monitor vendor advisories for updated builds of Backup Exec 11d and 12.0.

Detection

• Search endpoint logs and registry for the CLSID of PVATLCalendar.PVCalendar.1 and for pvcalendar.ocx on Backup Exec hosts.
• Monitor browser and process telemetry for iexplore.exe or other browsers loading pvcalendar.ocx, especially followed by unexpected child processes.
• Alert on crash dumps or stack-overflow exceptions originating from pvcalendar.ocx.
• Review proxy and DNS logs for known exploit-hosting domains and for traffic matching the Exploit-DB 5205 pattern.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.