dbcve.org
ExcelApplication · Microsoft

CVE-2007-3890

HIGH · 9.3 CVSS v2.0 Published 2007-08-14
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Microsoft Excel in Office 2000 SP3, Office XP SP3, Office 2003 SP2, and Office 2004 for Mac allows remote attackers to execute arbitrary code via a Workspace with a certain index value that triggers memory corruption.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

Memory corruption vulnerability in Microsoft Excel (Office 2000 SP3 through Office 2004 for Mac) where opening a specially crafted Workspace file with a specific index value triggers heap corruption, allowing attackers to execute arbitrary code with the user's privileges.

MitigationApply Microsoft security updates for the affected Office versions, and instruct users to avoid opening Workspace files from untrusted sources. Consider blocking .xlw Workspace file attachments at the email gateway.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
ExcelApplication
Affected:= 2000= 2003= 2004= xp_sp3
OfficeApplication
Affected:= 2000= 2003= 2004= xp

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
M
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete

AV:N/AC:M/Au:N/C:C/I:C/A:C

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Verify Excel is installed
    Open Excel, go to Help > About Microsoft Excel to view the exact version number. Alternatively, right-click the Excel executable in its installation folder (commonly C:\Program Files\Microsoft Office\OfficeXX\EXCEL.EXE) and check Properties > Details for the File Version.
    Affected if The installed version matches 2000, 2003, 2004 for Mac, or XP (any Service Pack) - these correspond to versions 9.0, 10.0, 11.0, and 12.0 respectively.
  2. Confirm the Office suite version
    If Excel is part of an Office suite, check the overall Office version by opening any Office application, going to Help > About, or checking the installation folder for the Office version (Office10 for Office XP, Office11 for 2003, Office12 for 2007).
    Affected if The Office suite version is 2000, 2003, 2004 for Mac, or XP (corresponds to Office 9.x, 10.x, 11.x, or 12.x).
  3. Identify if .xlw Workspace file handling is present
    Check for the presence of the Workspace file handler by attempting to open any .xlw file, or search for xlw file type registration in Windows Explorer by viewing file associations for the .xlw extension in Control Panel > Default Programs > Associate a file type or extension with a program.
    Affected if The system can open or recognize .xlw Workspace files, indicating the vulnerable file handler is present.
  4. Determine if the vulnerable feature is accessible
    The vulnerability triggers specifically when opening a specially crafted .xlw file with a particular index value. Since this is a crafted malicious file condition, the primary detection is version-based. Check whether Excel can process Workspace files at all - try to create or open a .xlw file if one exists.
    Affected if Excel can process .xlw Workspace files and the version falls within the affected range listed above.

A user is affected if Microsoft Excel (or Office containing Excel) version 2000, 2003, 2004 for Mac, or XP is installed and the application can open .xlw Workspace files.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Apply Microsoft security updates for the affected Office versions, and instruct users to avoid opening Workspace files from untrusted sources. Consider blocking .xlw Workspace file attachments at the email gateway.

Recommended fix High confidence

Apply Microsoft Security Bulletin MS07-025 (KB 938371)

  1. Locate and apply Microsoft Security Bulletin MS07-025 which addresses this vulnerability
  2. For Office 2000 SP3: Apply the MS07-025 update for Office 2000
  3. For Office XP SP3: Apply the MS07-025 update for Office XP
  4. For Office 2003 SP2: Apply the MS07-025 update for Office 2003
  5. For Office 2004 for Mac: Apply the MS07-025 update for Office 2004 for Mac
  6. Verify the update was successfully installed by checking Windows Update or the Add/Remove Programs list
Caveat These are legacy products with limited support; ensure compatibility with dependent systems before applying updates

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Excel Scoped from the published advisory
  • Consultation2.0 h
  • Implementation4.0 h
  • Testing2.0 h
  • Review / QA1.0 h
9.0 hours of engineering $1,600
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,560.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2007-3890 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2007-3890 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data