How severe is CVE-2007-5043?

CVE-2007-5043 has a CVSS 2.0 base score of 4.4, rated medium severity.

Is CVE-2007-5043 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (24th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2007-5043?

CVE-2007-5043 affects Kaspersky Lab Kaspersky Internet Security. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2007-5043?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2007-5043 published?

CVE-2007-5043 was published on 2007-09-24 and last updated on 2026-06-16.

CVE-2007-5043

CVE-2007-5043 is a medium-severity vulnerability in Kaspersky Lab Kaspersky Internet Security with a CVSS 2.0 base score of 4.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-20.

Key facts

Severity: Medium (CVSS 2.0 base score 4.4)
EPSS exploit prediction: 0% (24th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-20
Affected product: Kaspersky Lab Kaspersky Internet Security
Published: 2007-09-24
Last modified: 2026-06-16

Description

Kaspersky Internet Security 7.0.0.125 does not properly validate certain parameters to System Service Descriptor Table (SSDT) function handlers, which allows local users to (1) cause a denial of service (crash) and possibly gain privileges via the NtCreateSection kernel SSDT hook or (2) cause a denial of service (avp.exe service outage) via the NtLoadDriver kernel SSDT hook. NOTE: this issue may partially overlap CVE-2006-3074.

Frequently asked questions

What is CVE-2007-5043?: Kaspersky Internet Security 7.0.0.125 does not properly validate certain parameters to System Service Descriptor Table (SSDT) function handlers, which allows local users to (1) cause a denial of service (crash) and possibly gain privileges via the NtCreateSection kernel SSDT hook or (2) cause a denial of service (avp.exe service outage) via the NtLoadDriver kernel SSDT hook. NOTE: this issue may partially overlap CVE-2006-3074.
How severe is CVE-2007-5043?: CVE-2007-5043 has a CVSS 2.0 base score of 4.4, rated medium severity.
Is CVE-2007-5043 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (24th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2007-5043?: CVE-2007-5043 affects Kaspersky Lab Kaspersky Internet Security. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2007-5043?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2007-5043 published?: CVE-2007-5043 was published on 2007-09-24 and last updated on 2026-06-16.

References

Affected products (1)

cpe:2.3:a:kaspersky_lab:kaspersky_internet_security:7.0.0.125:*:*:*:*:*:*:*

More vulnerabilities in Kaspersky Lab Kaspersky Internet Security

CVE-2007-0445 — Critical (CVSS 10.0): Heap-based buffer overflow in the arj.ppl module in the OnDemand Scanner in Kaspersky Anti-Virus, Anti-Virus for…
CVE-2007-1112 — Critical (CVSS 10.0): Kaspersky Anti-Virus 6.0 and Internet Security 6.0 exposes unsafe methods in the (a) AXKLPROD60Lib.KAV60Info…
CVE-2007-1879 — Critical (CVSS 9.3): The StartUploading function in KL.SysInfo ActiveX control (AxKLSysInfo.dll) in Kaspersky Anti-Virus 6.0 and Internet…
CVE-2008-1518 — High (CVSS 7.2): Stack-based buffer overflow in kl1.sys in Kaspersky Anti-Virus 6.0 and 7.0 and Internet Security 6.0 and 7.0 allows…
CVE-2006-4926 — High (CVSS 7.2): The NDIS-TDI Hooking Engine, as used in the (1) KLICK (KLICK.SYS) and (2) KLIN (KLIN.SYS) device drivers 2.0.0.281 for…
CVE-2009-4452 — Medium (CVSS 6.8): Kaspersky Anti-Virus 5.0 (5.0.712); Antivirus Personal 5.0.x; Anti-Virus 6.0 (6.0.3.837), 7 (7.0.1.325), 2009…

All CVEs affecting Kaspersky Lab Kaspersky Internet Security →

Other CWE-20 (Improper Input Validation) vulnerabilities

CVE-2026-48316 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
CVE-2026-48281 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
CVE-2026-48277 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
CVE-2026-48055 — Critical (CVSS 10.0): Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and…
CVE-2026-34910 — Critical (CVSS 10.0): A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS…
CVE-2026-33587 — Critical (CVSS 10.0): Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and…

Browse all CWE-20 (Improper Input Validation) vulnerabilities →