{"api_version":"1","generated_at":"2026-07-23T07:15:05+00:00","cve":"CVE-2007-3681","urls":{"html":"https://cve.report/CVE-2007-3681","api":"https://cve.report/api/cve/CVE-2007-3681.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2007-3681","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2007-3681"},"summary":{"title":"CVE-2007-3681","description":"The IOCTL 9031 (BIOCGSTATS) handler in the NPF.SYS device driver in WinPcap before 4.0.1 allows local users to overwrite memory and execute arbitrary code via malformed Interrupt Request Packet (Irp) parameters.","state":"PUBLISHED","assigner":"mitre","published_at":"2007-07-11 17:30:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6.6","severity":"","vector":"AV:L/AC:M/Au:S/C:C/I:C/A:C","data":{"version":"2.0","vectorString":"AV:L/AC:M/Au:S/C:C/I:C/A:C","baseScore":6.6,"accessVector":"LOCAL","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"}}],"references":[{"url":"http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=550","name":"http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=550","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/473301/100/0/threaded","name":"http://www.securityfocus.com/archive/1/473301/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/473270/100/0/threaded","name":"http://www.securityfocus.com/archive/1/473270/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/24829","name":"http://www.securityfocus.com/bid/24829","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"WinPcap NPF.SYS BIOCGSTATS Parameters Local Privilege Escalation Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://osvdb.org/37889","name":"http://osvdb.org/37889","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.securityfocus.com/archive/1/473297/100/0/threaded","name":"http://www.securityfocus.com/archive/1/473297/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securitytracker.com/id?1018350","name":"http://securitytracker.com/id?1018350","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"WinPcap Input Validation Flaw in NPF.SYS Driver Lets Local Users Gain Elevated Privileges - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.winpcap.org/misc/changelog.htm","name":"http://www.winpcap.org/misc/changelog.htm","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"WinPcap · Change Log","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/35309","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/35309","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.exploit-db.com/exploits/4165","name":"https://www.exploit-db.com/exploits/4165","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"WinPcap 4.0 NPF.SYS Privilege Elevation Vulnerability PoC Exploit","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/25982","name":"http://secunia.com/advisories/25982","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"WinPcap NPF.SYS IOCTL Handler Privilege Escalation Vulnerability - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2007/2468","name":"http://www.vupen.com/english/advisories/2007/2468","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-3681","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-3681","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2007","cve_id":"3681","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"winpcap","cpe5":"winpcap","cpe6":"3.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2007","cve_id":"3681","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"winpcap","cpe5":"winpcap","cpe6":"4.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T14:28:51.997Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"1018350","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://securitytracker.com/id?1018350"},{"name":"winpcap-npf-code-execution(35309)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/35309"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.winpcap.org/misc/changelog.htm"},{"name":"4165","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/4165"},{"name":"25982","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/25982"},{"name":"37889","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/37889"},{"name":"20070709 WinPcap NPF.SYS Local Privilege Escalation Vulnerability","tags":["third-party-advisory","x_refsource_IDEFENSE","x_transferred"],"url":"http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=550"},{"name":"24829","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/24829"},{"name":"20070709 WinPcap NPF.SYS Privilege Elevation Vulnerability","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/473270/100/0/threaded"},{"name":"20070710 Re: WinPcap NPF.SYS Privilege Elevation Vulnerability","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/473297/100/0/threaded"},{"name":"20070710 Re: Re: WinPcap NPF.SYS Privilege Elevation Vulnerability","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/473301/100/0/threaded"},{"name":"ADV-2007-2468","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2007/2468"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2007-07-03T00:00:00.000Z","descriptions":[{"lang":"en","value":"The IOCTL 9031 (BIOCGSTATS) handler in the NPF.SYS device driver in WinPcap before 4.0.1 allows local users to overwrite memory and execute arbitrary code via malformed Interrupt Request Packet (Irp) parameters."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-15T20:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"1018350","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://securitytracker.com/id?1018350"},{"name":"winpcap-npf-code-execution(35309)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/35309"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.winpcap.org/misc/changelog.htm"},{"name":"4165","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/4165"},{"name":"25982","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/25982"},{"name":"37889","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/37889"},{"name":"20070709 WinPcap NPF.SYS Local Privilege Escalation Vulnerability","tags":["third-party-advisory","x_refsource_IDEFENSE"],"url":"http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=550"},{"name":"24829","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/24829"},{"name":"20070709 WinPcap NPF.SYS Privilege Elevation Vulnerability","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/473270/100/0/threaded"},{"name":"20070710 Re: WinPcap NPF.SYS Privilege Elevation Vulnerability","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/473297/100/0/threaded"},{"name":"20070710 Re: Re: WinPcap NPF.SYS Privilege Elevation Vulnerability","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/473301/100/0/threaded"},{"name":"ADV-2007-2468","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2007/2468"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2007-3681","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The IOCTL 9031 (BIOCGSTATS) handler in the NPF.SYS device driver in WinPcap before 4.0.1 allows local users to overwrite memory and execute arbitrary code via malformed Interrupt Request Packet (Irp) parameters."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"1018350","refsource":"SECTRACK","url":"http://securitytracker.com/id?1018350"},{"name":"winpcap-npf-code-execution(35309)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/35309"},{"name":"http://www.winpcap.org/misc/changelog.htm","refsource":"CONFIRM","url":"http://www.winpcap.org/misc/changelog.htm"},{"name":"4165","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/4165"},{"name":"25982","refsource":"SECUNIA","url":"http://secunia.com/advisories/25982"},{"name":"37889","refsource":"OSVDB","url":"http://osvdb.org/37889"},{"name":"20070709 WinPcap NPF.SYS Local Privilege Escalation Vulnerability","refsource":"IDEFENSE","url":"http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=550"},{"name":"24829","refsource":"BID","url":"http://www.securityfocus.com/bid/24829"},{"name":"20070709 WinPcap NPF.SYS Privilege Elevation Vulnerability","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/473270/100/0/threaded"},{"name":"20070710 Re: WinPcap NPF.SYS Privilege Elevation Vulnerability","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/473297/100/0/threaded"},{"name":"20070710 Re: Re: WinPcap NPF.SYS Privilege Elevation Vulnerability","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/473301/100/0/threaded"},{"name":"ADV-2007-2468","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2007/2468"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2007-3681","datePublished":"2007-07-11T17:00:00.000Z","dateReserved":"2007-07-11T00:00:00.000Z","dateUpdated":"2024-08-07T14:28:51.997Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2007-07-11 17:30:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:M/Au:S/C:C/I:C/A:C","baseScore":6.6,"accessVector":"LOCAL","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"MEDIUM","exploitabilityScore":2.7,"impactScore":10,"acInsufInfo":false,"obtainAllPrivilege":true,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:winpcap:winpcap:3.1:*:*:*:*:*:*:*","matchCriteriaId":"E6238750-894A-4C83-9686-86364ADCF971"},{"vulnerable":true,"criteria":"cpe:2.3:a:winpcap:winpcap:4.0:*:*:*:*:*:*:*","matchCriteriaId":"AB92E2F4-FAB4-4E79-9EA3-BF3023898EC8"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2007","CveId":"3681","Ordinal":"1","Title":"CVE-2007-3681","CVE":"CVE-2007-3681","Year":"2007"},"notes":[{"CveYear":"2007","CveId":"3681","Ordinal":"1","NoteData":"The IOCTL 9031 (BIOCGSTATS) handler in the NPF.SYS device driver in WinPcap before 4.0.1 allows local users to overwrite memory and execute arbitrary code via malformed Interrupt Request Packet (Irp) parameters.","Type":"Description","Title":"CVE-2007-3681"},{"CveYear":"2007","CveId":"3681","Ordinal":"2","NoteData":"2007-07-11","Type":"Other","Title":"Published"},{"CveYear":"2007","CveId":"3681","Ordinal":"3","NoteData":"2018-10-15","Type":"Other","Title":"Modified"}]}}}