CVE-2009-3031

Stack-based buffer overflow in the BrowseAndSaveFile method in the Altiris eXpress NS...

9.3 HighPublic exploit

Stack-based buffer overflow in the BrowseAndSaveFile method in the Altiris eXpress NS ConsoleUtilities ActiveX control 6.0.0.1846 in AeXNSConsoleUtilities.dll in Symantec Altiris Notification Server (NS) 6.0 before R12, Deployment Server 6.8 and 6.9 in Symantec Altiris Deployment Solution 6.9 SP3, and Symantec Management Platform (SMP) 7.0 before SP3 allows remote attackers to execute arbitrary code via a long string in the second argument.

Exploit likelihood

45.4%Down 28.2 points since Feb 4, 2022

What each source reports

NVD Score used 9.3

Record: CVE-2009-3031
CVSS 2.0: 9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

Record: CVE-2009-3031
Updated: 2026-11-02

EUVDEUVD-2009-3015 No score

Record: EUVD-2009-3015
Updated: 2026-11-03

GitHub AdvisoriesGHSA-fq54-rqwh-5q9h No score

Stack-based buffer overflow in the BrowseAndSaveFile method in the Altiris eXpress NS...

Record: GHSA-fq54-rqwh-5q9h
Weakness: CWE-119
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Symantec ConsoleUtilities - ActiveX Control Buffer Overflow (Metasploit)	2010-11-11
Exploit-DB	Symantec ConsoleUtilities - ActiveX Buffer Overflow (Metasploit)	2009-11-02
Metasploit	Symantec ConsoleUtilities ActiveX Control Buffer Overflow	2009-11-02

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2009-3031 is a high vulnerability (CVSS 9.3) in Symantec Altiris Deployment Solution, published November 3, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 45.4%, the 98th percentile. No source names a fixed version.