CVE-2007-2888: Stack-based buffer overflow in UltraISO 8.6.2.2011 and earlier allows user-assisted remote attackers to execut

Q: How do I fix CVE-2007-2888?

ultraiso: upgrade to newer than 8.6.2.2011. Exact commands for each OS are on this page.

Q: Is CVE-2007-2888 being exploited?

CVE-2007-2888 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2007-2888 affect?

CVE-2007-2888 affects ultraiso. Severity is high (CVSS 7.6). Stack-based buffer overflow in UltraISO 8.6.2.2011 and earlier allows user-assisted remote attackers to execute arbitrary code via a long FILE string (filename) in a .cue file, a related issue to CVE-2007-2761. NOTE: some details are obtai

Q: How urgent is CVE-2007-2888?

Priority 56/100. High severity; EPSS top 1%: very likely to be exploited; Public exploit reference

This week

HIGH 7.6UPGRADE

CVE-2007-2888 is a high-severity flaw (CVSS 7.6) affecting ultraiso. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Stack-based buffer overflow in UltraISO 8.6.2.2011 and earlier allows user-assisted remote attackers to execute arbitrary code via a long FILE string (filename) in a .cue file, a related issue to CVE-2007-2761. NOTE: some details are obtained from third party information.

Why this priority

High severity
EPSS top 1%: very likely to be exploited
Public exploit reference

A fixed release or distro patch exists.

Risk facts

CVSS score	7.6 (High)
EPSS exploit chance	54.7% (top 1%)
CISA exploited list	No
Published	2007-05-30
Last modified	2026-06-16

Publisher (CNA): MITRE · Vendor: ezb systems

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2007-05-30 01:30 UTCPublished CVE record published
2026-06-16 22:40 UTCUpdated Record last modified

ezb systems ultraiso UPGRADE

Affected: <= 8.6.2.2011

Fixed in: newer than 8.6.2.2011

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy ultraiso || rpm -q ultraiso || ultraiso --version

2. UPGRADE to newer than 8.6.2.2011 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade ultraiso

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade ultraiso

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Exploit-DB: UltraISO 8.6.2.2011 - '.cue/'.bin' Local Buffer Overflow (PoC)
Exploit-DB: UltraISO - '.cue' File Parsing Buffer Overflow (Metasploit)
Exploit-DB: UltraISO 8.6.2.2011 - '.cue/'.bin' Local Buffer Overflow (1)
Exploit-DB: UltraISO 8.6.2.2011 - '.cue/'.bin' Local Buffer Overflow (2)
Metasploit: UltraISO CUE File Parsing Buffer Overflow

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2007-2888?

ultraiso: upgrade to newer than 8.6.2.2011. Exact commands for each OS are on this page.

Is CVE-2007-2888 being exploited?

CVE-2007-2888 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2007-2888 affect?

CVE-2007-2888 affects ultraiso. Severity is high (CVSS 7.6). Stack-based buffer overflow in UltraISO 8.6.2.2011 and earlier allows user-assisted remote attackers to execute arbitrary code via a long FILE string (filename) in a .cue file, a related issue to CVE-2007-2761. NOTE: some details are obtai

How urgent is CVE-2007-2888?

Priority 56/100. High severity; EPSS top 1%: very likely to be exploited; Public exploit reference

Related CVEs

CVE-2018-25267 MEDIUM 6.2 DOWNGRADE UltraISO 9.7.1.3519 contains a local buffer overflow vulnerability in the Output FileName field of the Make CD
CVE-2017-2840 HIGH 7.8 DOWNGRADE A buffer overflow vulnerability exists in the ISO parsing functionality of EZB Systems UltraISO 9.6.6.3300
CVE-2010-5255 MEDIUM 6.9 DOWNGRADE Untrusted search path vulnerability in UltraISO 9.3.6.2750 allows local users to gain privileges via a Trojan
CVE-2009-1260 HIGH 9.3 UPGRADE Multiple stack-based buffer overflows in UltraISO 9.3.3.2685 and earlier allow remote attackers to cause a den
CVE-2008-4825 HIGH 9.3 DOWNGRADE Multiple buffer overflows in UltraISO 9.3.1.2633, and possibly other versions before 9.3.3.2685, allow user-as

References

← Back to latest CVEs