Vulnerability record · CVE-2010-1591 · published 28 April 2010

CVE-2010-1591: Rising-global rising antivirus improper input validation vulnerability

RRising Global · Rising Antivirus

Beijing Rising International Rising Antivirus 2008 through 2010 does not properly validate input to certain IOCTLs, including 0x83003C07, which allows local users to gain privileges via crafted IOCTL requests to the (1) HookCont.sys, (2) HookNtos.sys, (3) HOOKREG.sys, or (4) HookSys.sys device driver; or the (5) RsNTGdi.sys kernel module, reachable through \Device\RSNTGDI.

7.2 CVSS 2.0 High EPSS 1.6% · top 23.6% CWE-20 · Improper input validation

7.2CVSS 2.0 base score

1.6%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

14References, 6 tagged exploit

16 Jun 2026Last modified by NVD

Description

AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

RRising Antivirus Rising Global

References

Link	Tags
http://osvdb.org/61946
http://secunia.com/advisories/38335	Vendor Advisory
http://www.ntinternals.org/ntiadv0805/ntiadv0805.html	Exploit
http://www.ntinternals.org/ntiadv0902/ntiadv0902.html	Exploit
http://www.securityfocus.com/bid/37951	Exploit
http://www.vupen.com/english/advisories/2010/0218	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/55869
http://osvdb.org/61946
http://secunia.com/advisories/38335	Vendor Advisory
http://www.ntinternals.org/ntiadv0805/ntiadv0805.html	Exploit
http://www.ntinternals.org/ntiadv0902/ntiadv0902.html	Exploit
http://www.securityfocus.com/bid/37951	Exploit
http://www.vupen.com/english/advisories/2010/0218	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/55869

Track CVE-2010-1591 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.3CVE-2008-5539Rising-global rising antivirus improper input validation vulnerabilityRISING Antivirus 21.06.31.00 and possibly 20.61.42.00, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware …EPSS 10%12 Dec 2008 4.3CVE-2012-1457Antivirus TAR parser malware detection bypass via oversized length fieldThe TAR file parser in numerous antivirus and anti-malware products mishandles a TAR archive entry whose length field exceeds the total TAR file size…EPSS 100%analysed21 Mar 2012 4.3CVE-2012-1455NOD32 and Rising Antivirus CAB parser malware detection bypassThe CAB file parser in NOD32 Antivirus 5795 and Rising Antivirus 22.83.00.03 can be tricked into skipping malware detection when a CAB archive carrie…EPSS 59%analysed21 Mar 2012 4.3CVE-2012-1459TAR parser malware detection bypass in multiple antivirus productsThe TAR file parser in dozens of antivirus products mishandles a TAR archive entry whose length field spans the entire entry plus part of the next en…EPSS 100%analysed21 Mar 2012 4.3CVE-2012-1456Antivirus TAR parsers bypassed by appended ZIP fileMultiple antivirus products parse TAR archives in a way that lets a TAR file with an appended ZIP evade malware detection. An attacker can therefore …EPSS 100%analysed21 Mar 2012 4.3CVE-2012-1454Antivirus ELF parser malware detection bypass via modified ei_versionMultiple antivirus products, including Dr.Web, eSafe, McAfee Gateway, Rising, Fortinet and Panda, parse ELF files in a way that can be evaded by alte…EPSS 87%analysed21 Mar 2012 4.3CVE-2012-1461Gzip parser in multiple antivirus products allows malware detection bypassThe Gzip file parser in numerous antivirus and anti-malware products mishandles .tar.gz files containing multiple compressed streams, allowing a craf…EPSS 98%analysed21 Mar 2012 4.3CVE-2012-1449NOD32 and Rising Antivirus CAB parser malware detection bypassThe CAB file parser in NOD32 Antivirus 5795 and Rising Antivirus 22.83.00.03 can be tricked into missing malicious content by modifying the vMajor fi…EPSS 59%analysed21 Mar 2012

Source: NIST National Vulnerability Database (record CVE-2010-1591), CISA KEV, FIRST EPSS (scores of 2026-11-14). This page is refreshed as NVD updates the record.