CVE-2007-6189: Bitdefender Online Anti-Virus Scanner

High severity, CVSS 9.3. EPSS: 8.1% chance of exploitation in the next 30 days.

A certain ActiveX control in (1) OScan8.ocx and (2) Oscan81.ocx in BitDefender Online Anti-Virus Scanner 8.0 allows remote attackers to execute arbitrary code via a long argument to the InitX method that begins with a "%%" sequence, which is misinterpreted as a Unicode string and decoded twice, leading to improper memory allocation and a heap-based buffer overflow.

Affected products

• Bitdefender Online Anti-Virus Scanner: version 8.0 only

Published 2007-11-30. Last modified 2026-06-16.