Read the docs
TI-2009-04215 Aliases CVE-2009-4452GHSA-h766-w7jj-3628

Kaspersky Anti-Virus 5.0 (5.0.712); Antivirus Personal 5.0.x; Anti-Virus 6.0 (6.0.3.837)…

Priority LOW 32CWE-264Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-264.

Summary

Kaspersky Anti-Virus 5.0 (5.0.712); Antivirus Personal 5.0.x; Anti-Virus 6.0 (6.0.3.837), 7 (7.0.1.325), 2009 (8.0.0.x), and 2010 (9.0.0.463); and Internet Security 7 (7.0.1.325), 2009 (8.0.0.x), and 2010 (9.0.0.463); use weak permissions (Everyone:Full Control) for the BASES directory, which allows local users to gain SYSTEM privileges by replacing an executable or DLL with a Trojan horse.

Why it matters now

EPSS 0.00821 57th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 13

CPEVersionsRoleVendor
cpe:2.3:a:kaspersky_lab:kaspersky_anti-virus:5.0.712:*:windows_workstations:*:*:*:*:*5.0.712VulnerableKaspersky Lab
cpe:2.3:a:kaspersky_lab:kaspersky_anti-virus:6.0.3.837:*:windows_file_servers:*:*:*:*:*6.0.3.837VulnerableKaspersky Lab
cpe:2.3:a:kaspersky_lab:kaspersky_anti-virus:6.0.3.837:*:windows_workstation:*:*:*:*:*6.0.3.837VulnerableKaspersky Lab
cpe:2.3:a:kaspersky_lab:kaspersky_anti-virus:7.0.1.325:*:*:*:*:*:*:*7.0.1.325VulnerableKaspersky Lab
cpe:2.3:a:kaspersky_lab:kaspersky_anti-virus_2009:8.0.0.454:*:*:*:*:*:*:*8.0.0.454VulnerableKaspersky Lab
cpe:2.3:a:kaspersky_lab:kaspersky_anti-virus_2010:9.0.0.463:*:*:*:*:*:*:*9.0.0.463VulnerableKaspersky Lab
cpe:2.3:a:kaspersky_lab:kaspersky_anti-virus_personal:5.0:*:*:*:*:*:*:*5.0VulnerableKaspersky Lab
cpe:2.3:a:kaspersky_lab:kaspersky_anti-virus_personal:5.0.227:*:*:*:*:*:*:*5.0.227VulnerableKaspersky Lab
cpe:2.3:a:kaspersky_lab:kaspersky_anti-virus_personal:5.0.228:*:*:*:*:*:*:*5.0.228VulnerableKaspersky Lab
cpe:2.3:a:kaspersky_lab:kaspersky_anti-virus_personal:5.0.325:*:*:*:*:*:*:*5.0.325VulnerableKaspersky Lab
  • cpe:2.3:a:kaspersky_lab:kaspersky_anti-virus:5.0.712:*:windows_workstations:*:*:*:*:* Versions 5.0.712 Vulnerable ·Kaspersky Lab
  • cpe:2.3:a:kaspersky_lab:kaspersky_anti-virus:6.0.3.837:*:windows_file_servers:*:*:*:*:* Versions 6.0.3.837 Vulnerable ·Kaspersky Lab
  • cpe:2.3:a:kaspersky_lab:kaspersky_anti-virus:6.0.3.837:*:windows_workstation:*:*:*:*:* Versions 6.0.3.837 Vulnerable ·Kaspersky Lab
  • cpe:2.3:a:kaspersky_lab:kaspersky_anti-virus:7.0.1.325:*:*:*:*:*:*:* Versions 7.0.1.325 Vulnerable ·Kaspersky Lab
  • cpe:2.3:a:kaspersky_lab:kaspersky_anti-virus_2009:8.0.0.454:*:*:*:*:*:*:* Versions 8.0.0.454 Vulnerable ·Kaspersky Lab
  • cpe:2.3:a:kaspersky_lab:kaspersky_anti-virus_2010:9.0.0.463:*:*:*:*:*:*:* Versions 9.0.0.463 Vulnerable ·Kaspersky Lab
  • cpe:2.3:a:kaspersky_lab:kaspersky_anti-virus_personal:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Kaspersky Lab
  • cpe:2.3:a:kaspersky_lab:kaspersky_anti-virus_personal:5.0.227:*:*:*:*:*:*:* Versions 5.0.227 Vulnerable ·Kaspersky Lab
  • cpe:2.3:a:kaspersky_lab:kaspersky_anti-virus_personal:5.0.228:*:*:*:*:*:*:* Versions 5.0.228 Vulnerable ·Kaspersky Lab
  • cpe:2.3:a:kaspersky_lab:kaspersky_anti-virus_personal:5.0.325:*:*:*:*:*:*:* Versions 5.0.325 Vulnerable ·Kaspersky Lab
Show 3 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:kaspersky_lab:kaspersky_internet_security:7.0.1.325:*:*:*:*:*:*:*7.0.1.325VulnerableKaspersky Lab
cpe:2.3:a:kaspersky_lab:kaspersky_internet_security_2009:8.0.0.506:*:*:*:*:*:*:*8.0.0.506VulnerableKaspersky Lab
cpe:2.3:a:kaspersky_lab:kaspersky_internet_security_2010:9.0.0.463:*:*:*:*:*:*:*9.0.0.463VulnerableKaspersky Lab
  • cpe:2.3:a:kaspersky_lab:kaspersky_internet_security:7.0.1.325:*:*:*:*:*:*:* Versions 7.0.1.325 Vulnerable ·Kaspersky Lab
  • cpe:2.3:a:kaspersky_lab:kaspersky_internet_security_2009:8.0.0.506:*:*:*:*:*:*:* Versions 8.0.0.506 Vulnerable ·Kaspersky Lab
  • cpe:2.3:a:kaspersky_lab:kaspersky_internet_security_2010:9.0.0.463:*:*:*:*:*:*:* Versions 9.0.0.463 Vulnerable ·Kaspersky Lab

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2009-4452
  2. 2026-10-03 Alias added: GHSA-h766-w7jj-3628

References

Exploit 1

Advisory 1

  • TI-2005-02970 Heap-based buffer overflow in Kaspersky Antivirus (KAV) 5.0 and Kaspersky Personal… CVSS 2.0HIGH 10.0
  • TI-2004-00844 McAfee Anti-Virus Engine DATS drivers before 4398 released on Oct 13th 2004 and DATS… CVSS 2.0HIGH 7.5
  • TI-2007-00432 Heap-based buffer overflow in the arj.ppl module in the OnDemand Scanner in Kaspersky… CVSS 2.0HIGH 10.0
  • TI-2004-00845 Computer Associates (CA) InoculateIT 6.0, eTrust Antivirus r6.0 through r7.1, eTrust… CVSS 2.0HIGH 7.5
  • TI-2007-01080 Kaspersky Anti-Virus 6.0 and Internet Security 6.0 exposes unsafe methods in the (a)… CVSS 2.0HIGH 10.0
  • TI-2004-00993 Archive::Zip Perl module before 1.14, when used by antivirus programs such as… CVSS 2.0HIGH 7.5
See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences