CVE-2003-1246

NtCreateSymbolicLinkObject in ntdll.dll in Integrity Protection Driver (IPD) 1.2 and 1.3 allows local users to create and overwrite…

2.1LowCVSS base score
0.33%Exploitation in 30 daysEPSS · top 73% of all CVEs
NoKnown exploitednot in CISA's KEV catalog
NonePublic exploitsnone known yet

Description

NtCreateSymbolicLinkObject in ntdll.dll in Integrity Protection Driver (IPD) 1.2 and 1.3 allows local users to create and overwrite arbitrary files via a symlink attack on \winnt\system32\drivers using the subst command.

Timeline

2005
16 Nov 2005
16 Nov 2005
ID reserved
By mitre
16 Nov 2005
16 Nov 2005
Published
2024
17 Sept 202419 years later
17 Sept 2024· 19 years later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2003-1246, by who scored it
Scored by	CVSS	Score	Vector
NVDNVD · Modified	2.0	Low2.1	AV:L/AC:L/Au:N/C:N/I:P/A:N

EPSS (exploitation in 30 days): 0.33% · top 73% of all CVEs (9 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 2.1.

Affected products

n/a
- affected n/a

References

ipd-ntcreatesymboliclinkobject-subs-symlink(10979) (opens in a new tab)vdb-entryx_refsource_XFx_transferred
20030103 Pedestal Software Security Notice (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
20030103 Another way to bypass Integrity Protection Driver ('subst' vuln) (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
6511 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2003-1246](https://cveledger.app/badge/CVE-2003-1246.svg)](https://cveledger.app/cve/CVE-2003-1246)

Record last updated 17 Sept 2024, 01:01 UTC.