CVE-2007-1206

CVE-2007-1206 describes a local privilege escalation vulnerability affecting the Virtual DOS Machine (VDM) in various Microsoft Windows operating systems, including NT 4.0, 2000, XP, Server 2003, and Vista. The flaw stems from insecure permissions (PAGE_READWRITE) on a physical memory view, allowing a local attacker to modify the "zero page" during a race condition before the view is unmapped, thereby gaining elevated privileges. This vulnerability carries a CVSS score of 7.2, indicating high severity due to its local attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. The EPSS score is low, suggesting a minimal likelihood of exploitation in the wild. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are also minimal, aligning with the typical pattern for the majority of reported vulnerabilities.