CVE-2007-2884

CVE-2007-2884 describes multiple stack-based buffer overflows in Microsoft Visual Basic 6, affecting the handling of Visual Basic Project (vbp) files. An attacker can exploit this by crafting a vbp file with an excessively long "Description" or "Company Name" field. This vulnerability has a critical CVSS score of 9.3, indicating a high risk of denial of service (CPU consumption) or arbitrary code execution, requiring user interaction (e.g., opening the malicious file). While not listed on CISA's KEV catalog, proof-of-concept exploit code is publicly available on ExploitDB, though there is no evidence of active exploitation, Metasploit modules, or significant community discussion.