What is CVE-2007-6026?

CVE-2007-6026 is a vulnerability in Microsoft Jet, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2007-11-20.

Is CVE-2007-6026 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Buffer overflow in Microsoft Jet

CVE-2007-6026

Stack-based buffer overflow in Microsoft msjet40.dll 4.0.8618.0 (aka Microsoft Jet Engine), as used by Access 2003 in Microsoft Office 2003 SP3, allows user-assisted attackers to execute arbitrary code via a crafted MDB file database file containing a column structure with a modified column count. NOTE: this might be the same issue as CVE-2005-0944.

Vulnerability class: Buffer Overflow

Published 2007-11-20 · last modified 2026-06-16.

CVSS v2 metric

CVSS v2 base score 9.3 (High). Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.

EPSS exploit prediction

EPSS: 0.283 (98.1th percentile), scored 2026-09-29.

Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 98th percentile — 98.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.283 · newest: 0.283 · change: 0.000

Affected products

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

Public proof-of-concept exploits

ARPSyndicate/cve-scores

References

dvlabs.tippingpoint.com/advisory/TPTI-08-04
www.kb.cert.org/vuls/id/936529 (US Government Resource, third-party-advisory)
www.securityfocus.com/archive/1/483858/100/100/threaded (mailing-list)
www.securityfocus.com/archive/1/483888/100/100/threaded (mailing-list)
docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-028 (vendor-advisory)
securityreason.com/securityalert/3376 (third-party-advisory)
oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:5578 (signature, vdb-entry)
www.securityfocus.com/archive/1/492019/100/0/threaded (mailing-list)
www.securityfocus.com/bid/28398 (vdb-entry)
marc.info/ (vendor-advisory)

Frequently asked questions

What is CVE-2007-6026?: CVE-2007-6026 is a vulnerability in Microsoft Jet, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2007-11-20.
Is CVE-2007-6026 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.