CVE-2016-7255highunder attackransomware

CVE-2016-7255

Published 10 Nov 2016 · Updated 10 Sep 2026

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

95Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA, has a public proof of concept and 1 threat group(s) use it.

ssvc Actcvss 7.8epss 81%

from disclosure to weaponsame day

Published on NVDNov 10

1st PoCNov 9

CISA KEV+1819d

Who exploits it — 1

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

APT / StateAPT32🇻🇳 MITRE ATT&CK

Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

A flaw in Windows kernel graphics drivers allows someone with local access to run malicious code with system-level privileges, potentially taking full control of the computer.

Technical detail

Local privilege escalation vulnerability in win32k.sys affecting multiple Windows versions from Vista through Server 2016. Attack vector requires local access and a crafted application to exploit improper memory handling in kernel-mode drivers, resulting in arbitrary code execution with SYSTEM privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

n/a · n/a

public PoCs found — 18

exploitdbwww.exploit-db.com/exploits/40823unverified exploitdbwww.exploit-db.com/exploits/41015unverified exploitdbwww.exploit-db.com/exploits/40745unverified githubgithub.com/FSecureLABS/CVE-2016-7255★ 81 githubgithub.com/yuvatia/page-table-exploitation★ 11 githubgithub.com/heh3/CVE-2016-7255★ 3 githubgithub.com/bbolmin/cve-2016-7255_x86_x64★ 1 githubgithub.com/homjxi0e/CVE-2016-7255★ 0 cve_referencewww.exploit-db.com/exploits/41015/unverified cve_referencepacketstormsecurity.com/files/140468/Microsoft-Windows-Kernel-win32k.sys-NtSetWindowLongPtr-Privilege-Escalation.htmlunverified vulncheckvulncheck.com/xdb/b365d8ec807cunverified vulncheckvulncheck.com/xdb/f21c23b2b8d5unverified vulncheckvulncheck.com/xdb/1e9766c4be72unverified vulncheckvulncheck.com/xdb/1dd5ad8d8734unverified vulncheckvulncheck.com/xdb/ab696903a116unverified cve_referencewww.exploit-db.com/exploits/40823/unverified cve_referencewww.exploit-db.com/exploits/40745/unverified vulncheckvulncheck.com/xdb/0b26f77499e8unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://blog.trendmicro.com/trendlabs-security-intelligence/one-bit-rule-system-analyzing-cve-2016-7255-exploit-wild/http://packetstormsecurity.com/files/140468/Microsoft-Windows-Kernel-win32k.sys-NtSetWindowLongPtr-Privilege-Escalation.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-135 https://github.com/mwrlabs/CVE-2016-7255 https://securingtomorrow.mcafee.com/mcafee-labs/digging-windows-kernel-privilege-escalation-vulnerability-cve-2016-7255/https://security.googleblog.com/2016/10/disclosing-vulnerabilities-to-protect.html https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-7255 https://www.exploit-db.com/exploits/40745/https://www.exploit-db.com/exploits/40823/https://www.exploit-db.com/exploits/41015/http://www.securityfocus.com/bid/94064 http://www.securitytracker.com/id/1037251