CVE-2007-5086

CVE-2007-5086 describes a denial-of-service vulnerability affecting Kaspersky Anti-Virus and Internet Security 7.0 build 125. The flaw stems from improper validation of parameters to System Service Descriptor Table (SSDT) and Shadow SSDT function handlers, specifically within multiple kernel SSDT hooks in kylif.sys and the NtDuplicateObject hook. A local attacker can exploit this to crash the system. The vulnerability has a low severity rating (CVSS 2.1) with a low attack complexity, requiring local access and resulting in a denial of service. There is no impact on confidentiality or integrity. The vendor disputes the NtDuplicateObject vector as a vulnerability in their code. There is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE. Its EPSS score is very low, indicating a minimal likelihood of exploitation.