CVE-2007-0843

N/A Unknown
Published: February 23, 2007 Modified: April 23, 2026
View on NVD

Description

The ReadDirectoryChangesW API function on Microsoft Windows 2000, XP, Server 2003, and Vista does not check permissions for child objects, which allows local users to bypass permissions by opening a directory with LIST (READ) access and using ReadDirectoryChangesW to monitor changes of files that do not have LIST permissions, which can be leveraged to determine filenames, access times, and other sensitive information.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
http://lists.grok.org.uk/pipermail/full-disclosure/2007-February/052613.html
Source: cve@mitre.org
http://osvdb.org/33474
Source: cve@mitre.org
http://packetstormsecurity.com/files/163755/Microsoft-Windows-Malicious-Software-Removal-Tool-Privilege-Escalation.html
Source: cve@mitre.org
http://secunia.com/advisories/24245
Source: cve@mitre.org
Vendor Advisory
http://securityreason.com/securityalert/2282
Source: cve@mitre.org
http://securityvulns.com/advisories/readdirectorychanges.asp
Source: cve@mitre.org
Vendor Advisory
http://www.securityfocus.com/archive/1/460887/100/0/threaded
Source: cve@mitre.org
http://www.securityfocus.com/archive/1/460899/100/0/threaded
Source: cve@mitre.org
http://www.securityfocus.com/bid/22664
Source: cve@mitre.org
Exploit
http://www.vupen.com/english/advisories/2007/0701
Source: cve@mitre.org
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/32644
Source: cve@mitre.org
http://lists.grok.org.uk/pipermail/full-disclosure/2007-February/052613.html
Source: af854a3a-2127-422b-91ae-364da2661108
http://osvdb.org/33474
Source: af854a3a-2127-422b-91ae-364da2661108
http://packetstormsecurity.com/files/163755/Microsoft-Windows-Malicious-Software-Removal-Tool-Privilege-Escalation.html
Source: af854a3a-2127-422b-91ae-364da2661108
http://secunia.com/advisories/24245
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
http://securityreason.com/securityalert/2282
Source: af854a3a-2127-422b-91ae-364da2661108
http://securityvulns.com/advisories/readdirectorychanges.asp
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
http://www.securityfocus.com/archive/1/460887/100/0/threaded
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.securityfocus.com/archive/1/460899/100/0/threaded
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.securityfocus.com/bid/22664
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit
http://www.vupen.com/english/advisories/2007/0701
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/32644
Source: af854a3a-2127-422b-91ae-364da2661108

22 reference(s) from NVD

Quick Stats

CVSS v3 Score
N/A / 10.0
EPSS (Exploit Probability)
0.4%
59th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

CWE-264

Affected Vendors

microsoft

Related CVEs

CVE-2026-42615 7.2
CVE-2026-23773 4.3
CVE-2026-40560 N/A
CVE-2026-7363 N/A
CVE-2026-7361 N/A