CVE-2007-4676: Apple Mac OS X

High severity, CVSS 9.3. EPSS: 46.7% chance of exploitation in the next 30 days.

Heap-based buffer overflow in Apple QuickTime before 7.3 allows remote attackers to execute arbitrary code via malformed elements when parsing (1) Poly type (0x0070 through 0x0074) and (2) PackBitsRgn field (0x0099) opcodes in a PICT image.

Affected products

• Apple Mac OS X: version 10.3.9 only; version 10.4.10 only; version 10.5 only
• Microsoft Windows Vista: affected versions not specified
• Microsoft Windows XP: affected versions not specified

Published 2007-11-07. Last modified 2026-06-16.