What’s Vulnerable › Vulnerabilities

CVE-2005-3981

• Severity: medium (CVSS 4.9 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2005-12-04 · updated 2026-06-16

Description

NOTE: this issue has been disputed by third parties. Microsoft Windows XP, 2000, and 2003 allows local users to kill a writable process by using the CreateRemoteThread function with certain arguments on a process that has been opened using the OpenProcess function, possibly involving an invalid address for the start routine. NOTE: followup posts have disputed this issue, saying that if a user already has privileges to write to a process, then other functions could be called or the process could be terminated using PROCESS_TERMINATE

Affected products

• Microsoft Windows 2000: all versions
• Microsoft Windows 2003 Server: enterprise, enterprise-sp1, r2, r2-sp1, standard, standard-sp1 (+2)
• Microsoft Windows XP Service Pack 3: all versions

References

• http://www.securityfocus.com/archive/1/418289/100/0/threaded
• http://www.securityfocus.com/archive/1/418431/100/0/threaded
• http://www.securityfocus.com/bid/15671/
• http://www.securityfocus.com/archive/1/418289/100/0/threaded
• http://www.securityfocus.com/archive/1/418431/100/0/threaded
• http://www.securityfocus.com/bid/15671/

Get alerted when CVE-2005-3981 or the next vulnerability affects your stack