CVE-2007-0856: Trend Micro Client-Server-Messaging Security

High severity, CVSS 7.2. EPSS: 1% chance of exploitation in the next 30 days.

TmComm.sys 1.5.0.1052 in the Trend Micro Anti-Rootkit Common Module (RCM), with the VsapiNI.sys 3.320.0.1003 scan engine, as used in Trend Micro PC-cillin Internet Security 2007, Antivirus 2007, Anti-Spyware for SMB 3.2 SP1, Anti-Spyware for Consumer 3.5, Anti-Spyware for Enterprise 3.0 SP2, Client / Server / Messaging Security for SMB 3.5, Damage Cleanup Services 3.2, and possibly other products, assigns Everyone write permission for the \\.\TmComm DOS device interface, which allows local users to access privileged IOCTLs and execute arbitrary code or overwrite arbitrary memory in the kernel context.

Affected products

• Trend Micro Client-Server-Messaging Security: version 3.5 only
• Trend Micro Damage Cleanup Services: version 3.2 only
• Trend Micro Pc-Cillin Internet Security: version 2007 only
• Trend Micro Tmcomm.sys: version 1.5.1052 only
• Trend Micro Trend Micro Antirootkit Common Module: any version
• Trend Micro Trend Micro Antispyware: version 3.0_sp2 only; version 3.2_sp1 only; version 3.5 only
• Trend Micro Trend Micro Antivirus: version 2007 only
• Trend Micro Vsapini.sys: version 3.320.1003 only

Published 2007-02-08. Last modified 2026-06-16.