CVE-2007-2388: Apple Quicktime

High severity, CVSS 9.3. EPSS: 6% chance of exploitation in the next 30 days.

Apple QuickTime for Java 7.1.6 on Mac OS X and Windows does not properly restrict QTObject subclassing, which allows remote attackers to execute arbitrary code via a web page containing a user-defined class that accesses unsafe functions that can be leveraged to write to arbitrary memory locations.

Affected products

• Apple Quicktime: version 7.1.6 only

Published 2007-05-29. Last modified 2026-06-16.