What happened
The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
Affected versions
n/a: n/a Fixed: See vendor advisory.
Why it matters
Review the vendor advisory and exposure of the affected product to determine operational impact.
Detection & mitigation
- Apply vendor-provided updates or mitigations.
- Review affected product exposure and access logs.
Public PoC references
RepositoryAuthorFirst seenReference
packetstormsecurity.comNVD reference2016-11-10Verifiedgithub.comNVD reference2016-11-10Verifiedwww.exploit-db.comNVD reference2016-11-10Verifiedwww.exploit-db.comNVD reference2016-11-10Verifiedwww.exploit-db.comNVD reference2016-11-10VerifiedExploit-DB 40745Microsoft Windows Kernel - 'win32k' Denial of Service (MS16-135)TinySec2016-11-09VerifiedExploit-DB 40823Microsoft Windows Kernel - 'win32k.sys NtSetWindowLongPtr' Local Privilege Escalation (MS16-135) (1)IOactive2016-11-24VerifiedExploit-DB 41015Microsoft Windows Kernel - 'win32k.sys NtSetWindowLongPtr' Local Privilege Escalation (MS16-135) (2)Rick Larabee2017-01-08VerifiedSource timeline
CVE record published by NVDView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Record history
Record created from the first normalized source observation.
Metadata and source references refreshed.