CVE-2007-0603 json
PGP Desktop before 9.5.1 does not validate data objects received over the (1) \pipe\pgpserv named pipe for PGPServ.exe or the (2) \pipe\pgp…
published 2007-01-30 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-0601
- cvss
- 7.1
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 5.3%
- EPSS 5.3% chance of exploitation in 30 days, percentile 92%
- public exploits
- 0
- none known
Summary
PGP Desktop before 9.5.1 does not validate data objects received over the (1) \pipe\pgpserv named pipe for PGPServ.exe or the (2) \pipe\pgpsdkserv named pipe for PGPsdkServ.exe, which allows remote authenticated users to gain privileges by sending a data object representing an absolute pointer, which causes code execution at the corresponding address.
Exploit prediction
5.31% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.1 | AV:N/AC:H/Au:S/C:C/I:C/A:C |
References
-
ngssoftware.com
/advisories/medium-risk-vulnerability-in-pgp-desktop/
vendor-advisory
-
secunia.com
/advisories/23938
third-party-advisory, vendor-advisory
-
securitytracker.com
/id?1017563
vdb-entry
-
archives.neohapsis.com
/archives/vulnwatch/2007-q1/0025.html
mailing-list
-
securityreason.com
/securityalert/2203
third-party-advisory
-
osvdb.org
/32970
vdb-entry
-
securityfocus.com
/bid/22247
vdb-entry
-
securityfocus.com
/archive/1/458137/100/0/threaded
mailing-list
-
vupen.com
/english/advisories/2007/0356
vdb-entry
-
osvdb.org
/32969
vdb-entry
-
kb.cert.org
/vuls/id/102465
third-party-advisory, us-government-resource
Sources
- CVE List CVE-2007-0603
- NVD CVE-2007-0603
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.