Stack-based buffer overflow in the RPC interface for the Message Engine (mediasvr.exe) in CA BrightStor ARCServe BackUp v9.01 through R11.5…

published 2007-10-13 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-5307

cvss: 10.0; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 16.1%; EPSS 16.1% chance of exploitation in 30 days, percentile 96%
public exploits: 0; none known

Stack-based buffer overflow in the RPC interface for the Message Engine (mediasvr.exe) in CA BrightStor ARCServe BackUp v9.01 through R11.5, and Enterprise Backup r10.5, allows remote attackers to execute arbitrary code via a long argument in the 0x10d opnum.

Patch / fix

links 1

supportconnectw.ca.com/public/storage/infodocs/basb-secnotice.asp patch

Exploit prediction

16.08% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	2.0	10.0	AV:N/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

supportconnectw.ca.com /public/storage/infodocs/basb-secnotice.asp
patch
fortiguardcenter.com /advisory/FGA-2007-11.html
vendor-advisory
exchange.xforce.ibmcloud.com /vulnerabilities/37064
vdb-entry
secunia.com /advisories/27192
third-party-advisory
securityreason.com /securityalert/3218
third-party-advisory
ruder.cdut.net /blogview.asp?logID=231
securityfocus.com /archive/1/482112/100/0/threaded
mailing-list
securityfocus.com /archive/1/482121/100/0/threaded
mailing-list
exchange.xforce.ibmcloud.com /vulnerabilities/37065
vdb-entry
securityfocus.com /bid/26015
vdb-entry
securitytracker.com /id?1018805
vdb-entry
vupen.com /english/advisories/2007/3470
vdb-entry

Sources

CVE List CVE-2007-5327
NVD CVE-2007-5327

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary