CVE-2007-3681 EXPLOIT
6.6
MEDIUM · CVSS 2.0 · EPSS 2.4% (pctl 83)
Patch early
A public exploit exists.
Description
The IOCTL 9031 (BIOCGSTATS) handler in the NPF.SYS device driver in WinPcap before 4.0.1 allows local users to overwrite memory and execute arbitrary code via malformed Interrupt Request Packet (Irp) parameters.
Scoring
| CVSS | 6.6 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:L/AC:M/Au:S/C:C/I:C/A:C |
| EPSS | 2.38% — more likely to be exploited than 83% of all CVEs |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2007-07-11 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| winpcap | winpcap |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | WinPcap 4.0 - 'NPF.SYS' Local Privilege Escalation | 2007-07-10 |
References
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=550
- http://osvdb.org/37889
- http://secunia.com/advisories/25982
- http://securitytracker.com/id?1018350
- http://www.securityfocus.com/archive/1/473270/100/0/threaded
- http://www.securityfocus.com/archive/1/473297/100/0/threaded
- http://www.securityfocus.com/archive/1/473301/100/0/threaded
- http://www.securityfocus.com/bid/24829
- http://www.vupen.com/english/advisories/2007/2468
- http://www.winpcap.org/misc/changelog.htm
- https://exchange.xforce.ibmcloud.com/vulnerabilities/35309
- https://www.exploit-db.com/exploits/4165
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=550
- http://osvdb.org/37889
- http://secunia.com/advisories/25982
- http://securitytracker.com/id?1018350
- http://www.securityfocus.com/archive/1/473270/100/0/threaded
- http://www.securityfocus.com/archive/1/473297/100/0/threaded
- http://www.securityfocus.com/archive/1/473301/100/0/threaded
- http://www.securityfocus.com/bid/24829
→ the Explorer · watch your stack · NVD