CWE Code: 119
Vulnerability Type: privilege_escalation
CVSS Score: 6.9
CWE Name:  Improper Restriction of Operations within the Bounds of a Memory Buffer
Summary: double free vulnerability in microsoft windows 2000, xp, 2003, and vista allows local users to gain privileges by calling the messagebox function with a mb_service_notification message with crafted data, which sends a harderror message to client/server runtime server subsystem (csrss) process, which is not properly handled when invoking the userharderror and getharderrortext functions in winsrv.dll.
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: LOCAL
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2006-12-22
Last Modified Date: 2019-04-30