CVE-2009-0686

The TrendMicro Activity Monitor Module (tmactmon.sys) 2.52.0.1002 in Trend Micro Internet Pro...

7.2 HighPublic exploit

The TrendMicro Activity Monitor Module (tmactmon.sys) 2.52.0.1002 in Trend Micro Internet Pro 2008 and 2009, and Security Pro 2008 and 2009, allows local users to gain privileges via a crafted IRP in a METHOD_NEITHER IOCTL request to \Device\tmactmon that overwrites memory.

Exploit likelihood

0.80%Down 1.1 points since Feb 4, 2022

What each source reports

NVD Score used 7.2

Record: CVE-2009-0686
CVSS 2.0: 7.2 HighAV:L/AC:L/Au:N/C:C/I:C/A:C
Weakness: CWE-399
Updated: 2026-11-02

CVE List No score

Record: CVE-2009-0686
Updated: 2026-11-02

EUVDEUVD-2009-0686 No score

Record: EUVD-2009-0686
Updated: 2026-11-03

GitHub AdvisoriesGHSA-gfhg-7w8w-j26f No score

The TrendMicro Activity Monitor Module (tmactmon.sys) 2.52.0.1002 in Trend Micro Internet Pro...

Record: GHSA-gfhg-7w8w-j26f
Updated: 2026-11-02

Affected products

trendmicro internet security

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Trend Micro Internet Security Pro 2009 - Priviliege Escalation	2009-03-30

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2009-0686 is a high vulnerability (CVSS 7.2) in Trendmicro Internet Security, published April 1, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.80%, the 56th percentile. No source names a fixed version.