What is CVE-2007-4474?

CVE-2007-4474 is a vulnerability in IBM Domino Web Access, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2007-12-27.

Is CVE-2007-4474 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Buffer overflow in IBM Domino Web Access

CVE-2007-4474

Multiple stack-based buffer overflows in the IBM Lotus Domino Web Access ActiveX control, as provided by inotes6.dll, inotes6w.dll, dwa7.dll, and dwa7w.dll, in Domino 6.x and 7.x allow remote attackers to execute arbitrary code, as demonstrated by an overflow from a long General_ServerName property value when calling the InstallBrowserHelperDll function in the Upload Module in the dwa7.dwa7.1 control in dwa7w.dll 7.0.34.1.

Vulnerability class: Buffer Overflow

Published 2007-12-27 · last modified 2026-06-16.

CVSS v2 metric

CVSS v2 base score 9.3 (High). Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.

EPSS exploit prediction

EPSS: 0.442 (98.8th percentile), scored 2026-10-29.

Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 99th percentile — 98.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.442 · newest: 0.442 · change: 0.000

Affected products

IBM Domino Web Access — versions 6.0, 6.0.1, 6.0.1.1
IBM Lotus Domino Web Access — versions 7.0.1, 7.0.34.1

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

Public proof-of-concept exploits

rapid7/metasploit-framework

References

www.securitytracker.com/id (vdb-entry)
www.exploit-db.com/exploits/5111 (exploit)
www.securityfocus.com/bid/26972 (Exploit, vdb-entry)
lists.grok.org.uk/pipermail/full-disclosure/2007-December/059233.html (mailing-list, Exploit)
exchange.xforce.ibmcloud.com/vulnerabilities/39175 (vdb-entry)
www.exploit-db.com/exploits/4820 (exploit)
www.kb.cert.org/vuls/id/963889 (US Government Resource, third-party-advisory)
www.vupen.com/english/advisories/2007/4296 (vdb-entry)
secunia.com/advisories/28184 (Vendor Advisory, third-party-advisory)
www.exploit-db.com/exploits/4818 (exploit)

Frequently asked questions

What is CVE-2007-4474?: CVE-2007-4474 is a vulnerability in IBM Domino Web Access, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2007-12-27.
Is CVE-2007-4474 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.