CVE-2007-0646: Apple Imovie

High severity, CVSS 7.1. EPSS: 10.2% chance of exploitation in the next 30 days.

Format string vulnerability in iMovie HD 6.0.3, and Safari in Apple Mac OS X 10.4 through 10.4.10, allows remote user-assisted attackers to cause a denial of service (crash) via format string specifiers in a filename, which is not properly handled when calling the NSRunCriticalAlertPanel Apple AppKit function.

Affected products

• Apple Imovie: version 6.0.3 only
• Apple Mac OS X: version 10.3.9 only
• Apple Safari: any version

Published 2007-02-01. Last modified 2026-06-16.