Microsoft Windows Plug And Play UMPNPMGR.DLL wsprintfW Buffer Overflow Vulnerability

Microsoft Windows Plug And Play UMPNPMGR.DLL wsprintfW Buffer Overflow Vulnerability

Microsoft Windows Plug and Play is prone to a buffer overflow vulnerability. This issue is due to a failure of the service to properly bounds check user-supplied data prior to copying it to an insufficiently sized memory buffer.

This issue takes place when the PnP service handles malformed messages containing excessive data.

This vulnerability facilitates local privilege escalation and unauthorized remote access depending on the underlying operating system. A successful attack may result in arbitrary code execution resulting in an attacker gaining SYSTEM privileges.

This issue is unrelated to the one documented in BID 14513, "Microsoft Windows Plug and Play Buffer Overflow Vulnerability", but they both have similar attack scenarios and affects.