The IOCTL 9031 (BIOCGSTATS) handler in the NPF.SYS device driver in WinPcap before 4.0.1 allows local users to overwrite memory and execute…

published 2007-07-11 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-3665

cvss: 6.6; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 2.4%; EPSS 2.4% chance of exploitation in 30 days, percentile 83%
public exploits: 1; Exploit-DB

The IOCTL 9031 (BIOCGSTATS) handler in the NPF.SYS device driver in WinPcap before 4.0.1 allows local users to overwrite memory and execute arbitrary code via malformed Interrupt Request Packet (Irp) parameters.

Patch / fix

links 2

securityfocus.com/bid/24829 patch
secunia.com/advisories/25982 advisory

Timeline

2007-07-10 First public exploit (EDB-4165)
2007-07-11 Published

Exploit prediction

2.38% chance of exploitation in the next 30 days, higher than 83% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

EDB-4165 WinPcap 4.0 - 'NPF.SYS' Local Privilege Escalation local, 2007-07-10

CVSS scores

assigned by	version	score	vector
NVD	2.0	6.6	AV:L/AC:M/Au:S/C:C/I:C/A:C

References

secunia.com /advisories/25982
third-party-advisory, patch, vendor-advisory
securityfocus.com /bid/24829
vdb-entry, patch
exploit-db.com /exploits/4165
exploit
securitytracker.com /id?1018350
vdb-entry
exchange.xforce.ibmcloud.com /vulnerabilities/35309
vdb-entry
winpcap.org /misc/changelog.htm
osvdb.org /37889
vdb-entry
labs.idefense.com /intelligence/vulnerabilities/display.php?id=550
third-party-advisory
securityfocus.com /archive/1/473270/100/0/threaded
mailing-list
securityfocus.com /archive/1/473297/100/0/threaded
mailing-list
securityfocus.com /archive/1/473301/100/0/threaded
mailing-list
vupen.com /english/advisories/2007/2468
vdb-entry

Sources

CVE List CVE-2007-3681
NVD CVE-2007-3681

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary