CVE-2006-3455

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-10-23 · updated 2026-06-16

Description

The SAVRT.SYS device driver, as used in Symantec AntiVirus Corporate Edition 8.1 and 9.0.x up to 9.0.3, and Symantec Client Security 1.1 and 2.0.x up to 2.0.3, allows local users to execute arbitrary code via a modified address for the output buffer argument to the DeviceIOControl function.

Affected products

Symantec Client Security: 1.1, 1.1.1, 1.1.1_build_393, 1.1.1_mr1_build_8.1.1.314a, 1.1.1_mr2_build_8.1.1.319, 1.1.1_mr3_build_8.1.1.323 (+13)
Symantec Norton Antivirus: 8.1, 8.1.0.825a, 8.1.1, 8.1.1.319, 8.1.1.323, 8.1.1.329 (+16)

References

http://secunia.com/advisories/22536
http://securitytracker.com/id?1017108
http://securitytracker.com/id?1017109
http://www.securityfocus.com/archive/1/449524/100/0/threaded
http://www.securityfocus.com/bid/20684
http://www.symantec.com/avcenter/security/Content/2006.10.23.html
http://www.vupen.com/english/advisories/2006/4157
https://exchange.xforce.ibmcloud.com/vulnerabilities/29762
http://secunia.com/advisories/22536
http://securitytracker.com/id?1017108
http://securitytracker.com/id?1017109
http://www.securityfocus.com/archive/1/449524/100/0/threaded

Get alerted when CVE-2006-3455 or the next vulnerability affects your stack