CVE-2016-0167

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

The vulnerability CVE-2016-0167 resides in the kernel-mode driver component of Microsoft Windows, specifically identified as a Win32k elevation of privilege flaw. It affects Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511. The issue permits local users to gain elevated privileges by supplying a crafted application and is distinct from the related flaws CVE-2016-0143 and CVE-2016-0165.

An attacker who can execute code locally on an affected system, such as through a malicious application run by a standard user, can leverage the flaw to obtain higher privileges. The CVSS 7.8 rating indicates a local attack vector with low complexity that requires user interaction but can result in full confidentiality, integrity, and availability impact.

Microsoft security bulletin MS16-039 addresses the issue with available patches for the listed Windows versions and includes mitigation recommendations for administrators.