CVE-2017-0263
Published: 12 May 2017
Summary
CVE-2017-0263 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 4.3% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-6 (Least Privilege).
Deeper analysis
The vulnerability is a use-after-free flaw, tracked as CWE-416, in the Win32k kernel-mode drivers of Microsoft Windows. It affects Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold through 1703, and Windows Server 2016. The issue carries a CVSS 3.1 base score of 7.8 and is described as an elevation-of-privilege condition reachable from a local context.
Local users who can execute code on an affected system may exploit the flaw by running a specially crafted application. Successful exploitation grants the attacker elevated privileges, with the potential to achieve full control over confidentiality, integrity, and availability of the target system.
Microsoft published an advisory for CVE-2017-0263 that directs administrators to the corresponding security update. Public exploit code for the issue is available, confirming that working proof-of-concept attacks have been developed and shared.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2017-0619
Vulnerability details
The kernel-mode drivers in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allow local users to…
more
gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
- CWE(s)
- KEV Date Added
- 10 February 2022
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires applying the vendor security update that eliminates the Win32k use-after-free flaw before local exploitation can succeed.
Implements memory-protection safeguards that can block or contain use-after-free exploitation attempts in kernel-mode drivers.
Enforces least-privilege restrictions on local accounts so that successful exploitation yields only limited additional rights rather than full system control.