CVE-2014-4971
Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which...
CVE-2014-4971 is a high vulnerability (CVSS 7.2) in Microsoft Windows Xp, published July 26, 2014. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 23.0%, the 97th percentile. No source names a fixed version.
- Severity
- 7.2 HighCVSS 2.0, NVD
- Exploit chance
- 23.0%EPSS, 97th percentile
- Exploitation
- None known6 public exploits
- Fixed in
- No fix listedNo source names one
Description
Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write data to arbitrary memory locations, and consequently gain privileges, via a crafted address in an IOCTL call, related to (1) the MQAC.sys driver in the MQ Access Control subsystem and (2) the BthPan.sys driver in the Bluetooth Personal Area Networking subsystem.
Exploit likelihood
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | MS14-062 Microsoft Bluetooth Personal Area Networking (BthPan.sys) Privilege Escalation | 2014-07-18 |
| Exploit-DB | Microsoft Windows XP SP3 - 'MQAC.sys' Arbitrary Write Privilege Escalation | 2014-07-19 |
| Exploit-DB | Microsoft Windows XP SP3 - 'BthPan.sys' Arbitrary Write Privilege Escalation | 2014-07-21 |
| Metasploit | MQAC.sys Arbitrary Write Privilege Escalation | 2014-07-22 |
| Exploit-DB | Microsoft Windows XP SP3 - 'MQAC.sys' Arbitrary Write Privilege Escalation (Metasploit) | 2014-07-25 |
| Exploit-DB | Microsoft Bluetooth Personal Area Networking - 'BthPan.sys' Local Privilege Escalation (Metasploit) | 2014-10-15 |
What each source reports
NVD Score used
Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write data to arbitrary memory locations, and consequently gain privileges, via a crafted address in an IOCTL call, related to (1) the MQAC.sys driver in the MQ Access Control subsystem and (2) the BthPan.sys driver in the Bluetooth Personal Area Networking subsystem.
- Record
CVE-2014-4971- CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE ListNo score
Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write data to arbitrary memory locations, and consequently gain privileges, via a crafted address in an IOCTL call, related to (1) the MQAC.sys driver in the MQ Access Control subsystem and (2) the BthPan.sys driver in the Bluetooth Personal Area Networking subsystem.
- Record
CVE-2014-4971- Updated
- 2026-11-02
EUVDEUVD-2014-4886No score
Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write data to arbitrary memory locations, and consequently gain privileges, via a crafted address in an IOCTL call, related to (1) the MQAC.sys driver in the MQ Access Control subsystem and (2) the BthPan.sys driver in the Bluetooth Personal Area Networking subsystem.
- Record
EUVD-2014-4886- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r97w-68rj-55vfNo score
Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which...
Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write data to arbitrary memory locations, and consequently gain privileges, via a crafted address in an IOCTL call, related to (1) the MQAC.sys driver in the MQ Access Control subsystem and (2) the BthPan.sys driver in the Bluetooth Personal Area Networking subsystem.
- Record
GHSA-r97w-68rj-55vf- Weakness
- CWE-20
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| exploits, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
securitytracker.com/id/1031025
docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-062
securityfocus.com/bid/68764
blogs.technet.com/b/srd/archive/2014/10/14/accessing-risk-for-the-october-2014-security-updates.aspx
korelogic.com/Resources/Advisories/KL-001-2014-002.txt
Show 14 moreShow less
packetstormsecurity.com/files/127536/Microsoft-XP-SP3-MQAC.sys-Arbitrary-Write-Privilege-Escalation.html
exploit-db.com/exploits/34112
seclists.org/fulldisclosure/2014/Jul/97
osvdb.org/109387
secunia.com/advisories/60974
nvd.nist.gov/vuln/detail/CVE-2014-4971
github.com/advisories/GHSA-r97w-68rj-55vf