CVE-2006-3455

CVE-2006-3455 describes a local arbitrary code execution vulnerability in the SAVRT.SYS device driver, affecting Symantec AntiVirus Corporate Edition 8.1 and 9.0.x, and Symantec Client Security 1.1 and 2.0.x. An authenticated local attacker can exploit this by manipulating the output buffer argument of the DeviceIOControl function. With a CVSS score of 4.3, this vulnerability is considered low severity, requiring local access and user authentication for exploitation, and leading to potential partial confidentiality, integrity, and availability impacts. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage, indicating a low current threat landscape.