CVE-2014-4971

🗓️ 26 Jul 2014 15:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 68 Views🌐 WEB

Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, allowing local users to write data to arbitrary memory locations

Reporter	Title	Published	Views	Family All 33
0day.today	Microsoft XP SP3 BthPan.sys - Arbitrary Write Privilege Escalation	22 Jul 201400:00	–	zdt
0day.today	Microsoft XP SP3 MQAC.sys - Arbitrary Write Privilege Escalation Exploit	22 Jul 201400:00	–	zdt
0day.today	MQAC.sys Arbitrary Write Privilege Escalation Exploit	25 Jul 201400:00	–	zdt
0day.today	Microsoft Bluetooth Personal Area Networking (BthPan.sys) Privilege Escalation	16 Oct 201400:00	–	zdt
Circl	CVE-2014-4971	25 Jul 201400:00	–	circl
Cvelist	CVE-2014-4971	26 Jul 201415:00	–	cvelist
Exploit DB	Microsoft Windows XP SP3 - 'MQAC.sys' Arbitrary Write Privilege Escalation	19 Jul 201400:00	–	exploitdb
Exploit DB	Microsoft Windows XP SP3 - 'BthPan.sys' Arbitrary Write Privilege Escalation	21 Jul 201400:00	–	exploitdb
Exploit DB	Microsoft Windows XP SP3 - 'MQAC.sys' Arbitrary Write Privilege Escalation (Metasploit)	25 Jul 201400:00	–	exploitdb
Exploit DB	Microsoft Bluetooth Personal Area Networking - 'BthPan.sys' Local Privilege Escalation (Metasploit)	15 Oct 201400:00	–	exploitdb

NVD

Node

microsoft windows_xpsp3

Source	Link
securityfocus	www.securityfocus.com/archive/1/532843/100/0/threaded
securityfocus	www.securityfocus.com/archive/1/532844/100/0/threaded
seclists	www.seclists.org/fulldisclosure/2014/Jul/97
securitytracker	www.securitytracker.com/id/1031025
seclists	www.seclists.org/fulldisclosure/2014/Jul/96
packetstormsecurity	www.packetstormsecurity.com/files/127536/Microsoft-XP-SP3-MQAC.sys-Arbitrary-Write-Privilege-Escalation.html
korelogic	www.korelogic.com/Resources/Advisories/KL-001-2014-002.txt
packetstormsecurity	www.packetstormsecurity.com/files/128674/Microsoft-Bluetooth-Personal-Area-Networking-BthPan.sys-Privilege-Escalation.html
exploit-db	www.exploit-db.com/exploits/34112
blogs	www.blogs.technet.com/b/srd/archive/2014/10/14/accessing-risk-for-the-october-2014-security-updates.aspx

Parameter	Position	Path	Description	CWE
0x0012d814	path	\\.\\bthpan	Privilege escalation via IOCTL handling in BthPan.sys with HalDispatchTable corruption on Windows XP SP3.	CWE-20
0x1	path	\\.\\bthpan	Privilege escalation via IOCTL handling in BthPan.sys with HalDispatchTable corruption on Windows XP SP3.	CWE-20
0x258	path	\\.\\bthpan	Privilege escalation via IOCTL handling in BthPan.sys with HalDispatchTable corruption on Windows XP SP3.	CWE-20

06 May 2026 22:30Current

6.2Medium risk

Vulners AI Score6.2

CVSS 27.2

EPSS0.23441

CWE-20

microsoft windows xp sp3 irp handler routines local users memory locations privileges ioctl mqac.sys mq access control subsystem bthpan.sys bluetooth personal area networking subsystem security vulnerability nvd cve-2014-4971