CVE-2014-4971
Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which...
Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write data to arbitrary memory locations, and consequently gain privileges, via a crafted address in an IOCTL call, related to (1) the MQAC.sys driver in the MQ Access Control subsystem and (2) the BthPan.sys driver in the Bluetooth Personal Area Networking subsystem.
Exploit likelihood
What each source reports
NVD Score used
Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write data to arbitrary memory locations, and consequently gain privileges, via a crafted address in an IOCTL call, related to (1) the MQAC.sys driver in the MQ Access Control subsystem and (2) the BthPan.sys driver in the Bluetooth Personal Area Networking subsystem.
- Record
CVE-2014-4971- CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write data to arbitrary memory locations, and consequently gain privileges, via a crafted address in an IOCTL call, related to (1) the MQAC.sys driver in the MQ Access Control subsystem and (2) the BthPan.sys driver in the Bluetooth Personal Area Networking subsystem.
- Record
CVE-2014-4971- Updated
- 2026-11-02
EUVDEUVD-2014-4886 No score
Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write data to arbitrary memory locations, and consequently gain privileges, via a crafted address in an IOCTL call, related to (1) the MQAC.sys driver in the MQ Access Control subsystem and (2) the BthPan.sys driver in the Bluetooth Personal Area Networking subsystem.
- Record
EUVD-2014-4886- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r97w-68rj-55vf No score
Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which...
Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write data to arbitrary memory locations, and consequently gain privileges, via a crafted address in an IOCTL call, related to (1) the MQAC.sys driver in the MQ Access Control subsystem and (2) the BthPan.sys driver in the Bluetooth Personal Area Networking subsystem.
- Record
GHSA-r97w-68rj-55vf- Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Microsoft Windows XP SP3 - 'MQAC.sys' Arbitrary Write Privilege Escalation | 2014-07-19 |
| Exploit-DB | Microsoft Windows XP SP3 - 'BthPan.sys' Arbitrary Write Privilege Escalation | 2014-07-21 |
| Exploit-DB | Microsoft Windows XP SP3 - 'MQAC.sys' Arbitrary Write Privilege Escalation (Metasploit) | 2014-07-25 |
| Exploit-DB | Microsoft Bluetooth Personal Area Networking - 'BthPan.sys' Local Privilege Escalation (Metasploit) | 2014-10-15 |
| Metasploit | MS14-062 Microsoft Bluetooth Personal Area Networking (BthPan.sys) Privilege Escalation | 2014-07-18 |
| Metasploit | MQAC.sys Arbitrary Write Privilege Escalation | 2014-07-22 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-4971 is a high vulnerability (CVSS 7.2) in Microsoft Windows Xp, published July 26, 2014. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 23.0%, the 97th percentile. No source names a fixed version.
References
securitytracker.com/id/1031025
docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-062
securityfocus.com/bid/68764
blogs.technet.com/b/srd/archive/2014/10/14/accessing-risk-for-the-october-2014-security-updates.aspx
korelogic.com/Resources/Advisories/KL-001-2014-002.txt
Show 14 moreShow less
packetstormsecurity.com/files/127536/Microsoft-XP-SP3-MQAC.sys-Arbitrary-Write-Privilege-Escalation.html
exploit-db.com/exploits/34112
seclists.org/fulldisclosure/2014/Jul/97
osvdb.org/109387
secunia.com/advisories/60974
nvd.nist.gov/vuln/detail/CVE-2014-4971
github.com/advisories/GHSA-r97w-68rj-55vf