Untrusted search path vulnerability in Windows Mail and Windows Meeting Space in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .eml or .wcinv file, aka "Windows Mail Insecure Library Loading Vulnerability."
Published Nov 8, 2011
7.3
HIGHCVSS 3.1
EPSS 8.32%
Description
Untrusted search path vulnerability in Windows Mail and Windows Meeting Space in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .eml or .wcinv file, aka "Windows Mail Insecure Library Loading Vulnerability."
Affected products
No data.
- n/a
- n/a
- n/a
- n/a
- n/a
- n/a
- r2
- r2
- n/a
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
No CVSS v3.0 score for this CVE.
AV:N/AC:M/Au:N/C:C/I:C/A:C
This CVE is not in the KEV list.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
NoneAutomatable
NoTechnical Impact
TotalDecision
n/aAssessed Jun 4, 2025 · SSVC 2.0.3
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
2022–2026- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (24 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 8.32% (0.08321) | 94.78th | v5 (v2026.06.15) |
| Jun 23, 2026 | 8.10% (0.08103) | 94.08th | v5 (v2026.06.15) |
| Jun 15, 2026 | 9.67% (0.09669) | 94.86th | v5 (v2026.06.15) |
| Aug 25, 2025 | 15.61% (0.15610) | 94.43th | v4 (v2025.03.14) |
| Jul 9, 2025 | 12.12% (0.12119) | 93.48th | v4 (v2025.03.14) |
| Jun 25, 2025 | 14.28% (0.14280) | 94.04th | v4 (v2025.03.14) |
| Jun 5, 2025 | 18.23% (0.18235) | 94.85th | v4 (v2025.03.14) |
| Mar 30, 2025 | 27.19% (0.27187) | 95.97th | v4 (v2025.03.14) |
| Mar 29, 2025 | 41.15% (0.41148) | 96.09th | v4 (v2025.03.14) |
| Mar 19, 2025 | 27.19% (0.27187) | 95.77th | v4 (v2025.03.14) |
| Mar 17, 2025 | 25.59% (0.25588) | 95.78th | v4 (v2025.03.14) |
| Dec 12, 2024 | 0.18% (0.00184) | 56.95th | v3 (v2023.03.01) |
| May 8, 2024 | 0.18% (0.00184) | 55.33th | v3 (v2023.03.01) |
| Mar 16, 2024 | 0.26% (0.00261) | 65.11th | v3 (v2023.03.01) |
| Feb 8, 2024 | 0.34% (0.00338) | 70.54th | v3 (v2023.03.01) |
| Jan 21, 2024 | 0.34% (0.00338) | 68.38th | v3 (v2023.03.01) |
| Nov 27, 2023 | 0.28% (0.00279) | 64.88th | v3 (v2023.03.01) |
| Oct 4, 2023 | 0.24% (0.00235) | 61.19th | v3 (v2023.03.01) |
| Jun 8, 2023 | 0.37% (0.00367) | 68.51th | v3 (v2023.03.01) |
| Apr 5, 2023 | 0.24% (0.00238) | 60.22th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.17% (0.00165) | 51.33th | v3 (v2023.03.01) |
| Mar 6, 2023 | 17.03% (0.17034) | 96.20th | v2 (v2022.01.01) |
| Apr 1, 2022 | 17.03% (0.17034) | 95.85th | v2 (v2022.01.01) |
| Feb 4, 2022 | 17.03% (0.17034) | 93.02th | v2 (v2022.01.01) |
No CWE recorded.
References (2)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-085 vendor-advisoryx_refsource_MS
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14028 vdb-entrysignaturex_refsource_OVAL
| Link | Providers | Tags |
|---|---|---|
| https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-085 | vendor-advisoryx_refsource_MS | |
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14028 | vdb-entrysignaturex_refsource_OVAL |
Change history (0)
No recorded changes yet.