CVE-2016-0165

Deeper analysis

The vulnerability is an elevation of privilege flaw in the kernel-mode win32k driver present in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511. It is triggered when a local user runs a specially crafted application, enabling the attacker to execute arbitrary code with elevated privileges; the issue is distinct from the related win32k flaws tracked as CVE-2016-0143 and CVE-2016-0167.

An attacker with the ability to execute code on an affected system, such as through a malicious executable or compromised user account, can leverage the flaw to obtain higher privileges without requiring prior administrative rights. Successful exploitation grants the attacker the same rights as the win32k process, typically resulting in full control over the target system.

Microsoft addressed the issue in security bulletin MS16-039, which supplies updated win32k drivers for all affected platforms; administrators are advised to install the patches through Windows Update or the Microsoft Download Center as the primary mitigation. Public exploit code for the vulnerability has been posted to Exploit-DB.

The CVSS 7.8 score reflects a local attack vector with low complexity that requires user interaction to open the crafted application.