CVE-2007-4277: Trend Micro Pc-Cillin Internet Security 2007

Medium severity, CVSS 6.6. EPSS: 0.4% chance of exploitation in the next 30 days.

The Trend Micro AntiVirus scan engine before 8.550-1001, as used in Trend Micro PC-Cillin Internet Security 2007, and Tmxpflt.sys 8.320.1004 and 8.500.0.1002, has weak permissions (Everyone:Write) for the \\.\Tmfilter device, which allows local users to send arbitrary content to the device via the IOCTL functionality. NOTE: this can be leveraged for privilege escalation by exploiting a buffer overflow in the handler for IOCTL 0xa0284403.

Affected products

• Trend Micro Pc-Cillin Internet Security 2007: any version
• Trend Micro Scan Engine: up to and including 8.500

Published 2007-10-30. Last modified 2026-06-16.