Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Windows 2000/XP/2003 HTML Help can run any code

CVE-2007-0214 · published 19 years ago
Summary

The HTML Help component (hhctrl.ocx) in Windows 2000, Windows XP and Windows Server 2003 can be tricked into running any program an attacker provides. This could let someone take control of the computer without the user’s knowledge. Install the latest Microsoft security updates or disable the HTML Help feature if it is not needed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
microsoft windows_2000 All versions
cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*
microsoft windows_2003_server 64-bit
itanium
sp1
cpe:2.3:o:microsoft:windows_2003_server:*:*:*:*:*:*:*:*
microsoft windows_xp All versions
cpe:2.3:o:microsoft:windows_xp:*:*:64-bit:*:*:*:*:*
Original advisory text
The HTML Help ActiveX control (Hhctrl.ocx) in Microsoft Windows 2000 SP3, XP SP2 and Professional, 2003 SP1 allows remote attackers to execute arbitrary code via unspecified functions, related to u...
The HTML Help ActiveX control (Hhctrl.ocx) in Microsoft Windows 2000 SP3, XP SP2 and Professional, 2003 SP1 allows remote attackers to execute arbitrary code via unspecified functions, related to uninitialized parameters.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.3 Critical
Exploitation
27% chance of attack within 30 days
Timeline
Published13 Feb 2007
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2007-0214 · NVD
Track software like this
Free during beta