CVE-2007-0856

CVE-2007-0856 describes a critical vulnerability in Trend Micro's TmComm.sys driver (version 1.5.0.1052) and VsapiNI.sys scan engine (version 3.320.0.1003), affecting numerous Trend Micro products including PC-cillin Internet Security 2007, Antivirus 2007, and various Anti-Spyware and Client/Server/Messaging Security suites. The vulnerability allows local users to gain elevated privileges by exploiting improper permissions on the \\.\TmComm DOS device interface. This enables attackers to access privileged IOCTLs, leading to arbitrary code execution or memory overwrites within the kernel context. With a CVSS score of 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C), this vulnerability is considered highly severe, requiring local access but having low attack complexity. Its potential impact includes complete compromise of confidentiality, integrity, and availability of the affected system. Despite its severity, there is no evidence of active exploitation, nor is exploit code publicly available on platforms like Metasploit or ExploitDB. The vulnerability has received minimal community attention and media coverage, suggesting it is not widely known or actively targeted.