Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write data to arbitrary m…

1. 2014-07-18 First public exploit (Metasploit exploit/windows/local/bthpan)
2. 2014-07-26 Published

23.05% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-09).

• Metasploit exploit/windows/local/mqac_write MQAC.sys Arbitrary Write Privilege Escalation metasploit exploit, average rank, 2014-07-22
• Metasploit exploit/windows/local/bthpan MS14-062 Microsoft Bluetooth Personal Area Networking (BthPan.sys) Privilege Escalation metasploit exploit, average rank, 2014-07-18
• EDB-34982 Microsoft Bluetooth Personal Area Networking - 'BthPan.sys' Local Privilege Escalation (Metasploit) local, 2014-10-15
• EDB-34167 Microsoft Windows XP SP3 - 'MQAC.sys' Arbitrary Write Privilege Escalation (Metasploit) local, 2014-07-25
• EDB-34131 Microsoft Windows XP SP3 - 'BthPan.sys' Arbitrary Write Privilege Escalation local, 2014-07-21
• EDB-34112 Microsoft Windows XP SP3 - 'MQAC.sys' Arbitrary Write Privilege Escalation local, 2014-07-19
• korelogic.com https://www.korelogic.com/Resources/Advisories/KL-001-2014-002.txt referenced PoC, tagged "exploit" by a source, unverified
• korelogic.com https://www.korelogic.com/Resources/Advisories/KL-001-2014-003.txt referenced PoC, tagged "exploit" by a source, unverified
• packetstormsecurity.com http://packetstormsecurity.com/files/128674/Microsoft-Bluetooth-Personal-Area-Networking-BthPan.sys-Privilege-Escalation.html referenced PoC, tagged "exploit" by a source, unverified
• seclists.org http://seclists.org/fulldisclosure/2014/Jul/97 referenced PoC, tagged "exploit" by a source, unverified
• seclists.org http://seclists.org/fulldisclosure/2014/Jul/96 referenced PoC, tagged "exploit" by a source, unverified

Weakness

• CWE-20 Improper Input Validation

• exploit-db.com /exploits/34112

  exploit

• exploit-db.com /exploits/34131

  exploit

• exploit-db.com /exploits/34982

  exploit

• korelogic.com /Resources/Advisories/KL-001-2014-002.txt

  exploit

• korelogic.com /Resources/Advisories/KL-001-2014-003.txt

  exploit

• packetstormsecurity.com /files/128674/Microsoft-Bluetooth-Personal-Area-Networking-BthPan.sys-Privilege-Escalation.html

  exploit, vdb-entry

• seclists.org /fulldisclosure/2014/Jul/97

  mailing-list, exploit

• seclists.org /fulldisclosure/2014/Jul/96

  mailing-list, exploit

• docs.microsoft.com /en-us/security-updates/securitybulletins/2014/ms14-062

  vendor-advisory

• blogs.technet.com /b/srd/archive/2014/10/14/accessing-risk-for-the-october-2014-security-updates.aspx

  vendor-advisory

• securitytracker.com /id/1031025

  vdb-entry, third-party-advisory

• securityfocus.com /bid/68764

  vdb-entry

• securityfocus.com /archive/1/532844/100/0/threaded

  mailing-list

• packetstormsecurity.com /files/127536/Microsoft-XP-SP3-MQAC.sys-Arbitrary-Write-Privilege-Escalation.html
• packetstormsecurity.com /files/127535/Microsoft-XP-SP3-BthPan.sys-Arbitrary-Write-Privilege-Escalation.html
• securityfocus.com /archive/1/532843/100/0/threaded

  mailing-list

• osvdb.org /109387

  vdb-entry, broken-link

• secunia.com /advisories/60974

  third-party-advisory, permissions-required

• CVE List CVE-2014-4971
• NVD CVE-2014-4971

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.