CVE-2007-0127: Opera Browser

High severity, CVSS 9.3. EPSS: 4.8% chance of exploitation in the next 30 days.

The Javascript SVG support in Opera before 9.10 does not properly validate object types in a createSVGTransformFromMatrix request, which allows remote attackers to execute arbitrary code via JavaScript code that uses an invalid object in this request that causes a controlled pointer to be referenced during the virtual function call.

Affected products

• Opera Opera Browser: up to and including 9.02; version 1.00 only; version 2.00 only; version 2.10 only; version 2.12 only; version 3.00 only; …

Published 2007-01-09. Last modified 2026-06-16.