CVE-2016-0040

Deeper analysis

The vulnerability is an elevation of privilege flaw in the Windows kernel, tracked as CVE-2016-0040 and also known as the Windows Elevation of Privilege Vulnerability. It affects Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1. The issue permits a local attacker to execute a specially crafted application that results in higher privileges on the affected system, with a CVSS 3.1 base score of 7.8 reflecting local access, low attack complexity, and high impact on confidentiality, integrity, and availability.

An attacker with the ability to run code on a vulnerable system can exploit the flaw by supplying a crafted application. Because the vector is local and requires no prior privileges, a standard user who launches the malicious application can obtain elevated rights, potentially allowing full control over the target machine.

Microsoft addressed the issue in security bulletin MS16-014, which provides patches for the listed Windows versions. The bulletin and associated SecurityTracker entries recommend applying the updates to eliminate the vulnerability. Public exploit code for the issue has been published on Exploit-DB.