CVE-2016-0099
Microsoft Windows Secondary Logon Service Privilege Escalation Vulnerability
Description
CVE-2016-0099 is a high-severity vulnerability affecting Microsoft Windows, carrying a CVSS 3.1 base score of 7.8. Classified under CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')), this vulnerability allows an attacker to compromise the security of the affected system by exploiting improper handling in the software's processing logic. This CVE has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog on 2022-03-03, confirming active exploitation in the wild with a federal remediation deadline of 2022-03-24. With an EPSS score of 90.4% (99.60th percentile), the probability of exploitation activity is significantly elevated compared to other known vulnerabilities. Notably, this vulnerability has been associated with ransomware campaigns, underscoring its attractiveness to financially motivated threat actors.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | - |
| microsoft | windows 10 1511 | - |
| microsoft | windows 7 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows vista | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://www.securityfocus.com/bid/84034(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1035210(Broken Link, Third Party Advisory, VDB Entry)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-032(Patch, Vendor Advisory)
- https://www.exploit-db.com/exploits/39574/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/39719/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/39809/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/40107/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-0099(US Government Resource)
Weakness Type
CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Classic Buffer Overflow is a vulnerability that occurs when a program copies data to a buffer without first checking that the data fits within the buffer's allocated size. This typically happens when functions like strcpy(), gets(), sprintf(), or memcpy() are used without proper bounds checking. When the input data exceeds the buffer capacity, it overwrites adjacent memory locations, potentially corrupting data, crashing the program, or enabling arbitrary code execution. This vulnerability class has been responsible for numerous high-profile security breaches and remains a critical concern in C/C++ applications despite decades of awareness. This category of weakness is particularly relevant in the context of Microsoft Windows, where the security boundary between user-supplied input and system-level processing must be carefully maintained to prevent exploitation. Understanding the underlying weakness mechanism is essential for both assessing the risk posed by CVE-2016-0099 and implementing effective countermeasures.
In the specific case of CVE-2016-0099, the buffer copy without checking size of input ('classic buffer overflow') manifests within Microsoft Windows's processing components. Buffer overflows are among the most dangerous vulnerabilities in software security. Attackers can exploit them to overwrite function return addresses, redirecting program execution to injected shellcode. Stack-based overflows enable reliable code execution through return-oriented programming (ROP) and other techniques that bypass modern protections like DEP/NX. Heap overflows can corrupt memory management structures for similar effect. Even with exploit mitigations, buffer overflows frequently cause denial of service through crashes. Critical systems written in C/C++ including operating systems, network services, and embedded devices remain at risk. The Morris Worm (1988), Code Red (2001), and Heartbleed (2014) all exploited buffer-related vulnerabilities. The remediation strategy for this weakness class involves use safe string handling functions with explicit bounds checking: strncpy(), snprintf(), strlcpy(), or platform-specific safe alternatives like strcpy_s(). better yet, use languages with autom. Organizations relying on Microsoft Windows should prioritize patching this vulnerability, as the weakness class it belongs to is a well-understood and frequently targeted attack surface.
Learn more: CWE-120 — Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Impact Analysis
CVE-2016-0099 carries a CVSS 3.1 base score of 7.8 (HIGH), reflecting its significant potential for harm across multiple impact dimensions.
Confidentiality (HIGH): An attacker who successfully exploits this vulnerability gains the ability to access sensitive data stored on or processed by the affected system. This includes configuration files, credentials, cryptographic keys, and potentially proprietary or regulated data. In environments where the compromised system handles personally identifiable information (PII) or financial records, the confidentiality breach could trigger regulatory compliance violations and significant reputational damage.
Integrity (HIGH): Successful exploitation permits the attacker to modify data, install backdoors, alter system configurations, or inject malicious code. This level of integrity compromise means the attacker can manipulate the system to serve their objectives, whether that involves deploying ransomware, establishing persistent access, or pivoting to other systems within the network. The trustworthiness of the affected system is completely undermined once integrity is compromised at this level.
Availability (HIGH): The vulnerability can be leveraged to completely disrupt the availability of the affected service or device. An attacker can force a system crash, trigger a reload, or render the device inoperable, causing significant operational disruption. For critical infrastructure components like network devices or security appliances, even brief availability outages can have cascading effects across the organization.
Scope (Unchanged): The scope is Unchanged, meaning the impact of the vulnerability is limited to the affected component itself. While the consequences within that component can be severe, the exploitation does not directly extend to other systems or security domains.
With an EPSS score of 90.4% (99.60th percentile), this vulnerability ranks among the most likely to be exploited, reinforcing the urgency of immediate remediation.
Exploit Maturity
CVE-2016-0099 has confirmed active exploitation in the wild, as evidenced by its inclusion in CISA's Known Exploited Vulnerabilities catalog.
Active Exploitation: This vulnerability was added to the CISA KEV catalog on 2022-03-03, confirming that threat actors have actively exploited it in real-world attacks against organizations. The KEV listing represents a high-confidence indicator of exploitation, as CISA requires evidence of active exploitation before adding vulnerabilities to this catalog. Federal agencies were required to remediate this vulnerability by the deadline of 2022-03-24.
Ransomware Association: CISA's KEV catalog confirms that this vulnerability has been leveraged in ransomware campaigns. Ransomware operators frequently target known exploited vulnerabilities as part of their initial access strategy, making this CVE a high-priority remediation target for organizations seeking to reduce their exposure to ransomware threats. The association with ransomware indicates that exploit tooling is mature and readily available to threat actors of varying sophistication levels.
Public Exploits: Proof-of-concept or functional exploit code is publicly available, significantly lowering the barrier to exploitation. Known exploit references include: Exploit, Exploit, Exploit, Exploit. The availability of public exploit code means that even less sophisticated attackers can weaponize this vulnerability, increasing the overall threat level.
EPSS Score: The EPSS score of 90.4% places this in the 99.60th percentile, indicating near-certain ongoing exploitation activity. This is among the highest-risk vulnerabilities tracked by EPSS.
KEV Remediation Deadline: 2022-03-24. Federal agencies under BOD 22-01 were required to remediate by this date, and all organizations are strongly encouraged to treat this deadline as a benchmark for their own patch management timelines.
Remediation
- Apply the vendor-provided security update immediately. Follow the guidance in the official security advisory: Vendor Advisory. This is the primary remediation action specified in the CISA KEV catalog: "Apply updates per vendor instructions." Ensure all affected versions are upgraded to a patched release as soon as possible.
- Verify all affected product versions are addressed. The following products and versions are known to be vulnerable: microsoft windows 10 1507 (-); microsoft windows 10 1511 (-); microsoft windows 7 (-); microsoft windows 8.1 (-); microsoft windows server 2008 (-; r2). Conduct an inventory of your environment to identify all instances of these products and ensure each one receives the appropriate update.
- Enforce the principle of least privilege on affected systems. Ensure that user accounts have only the minimum permissions necessary for their function. This limits the impact of local exploitation attempts by reducing the privileges available to an attacker.
- Implement application whitelisting and endpoint detection. Deploy endpoint detection and response (EDR) solutions to monitor for exploitation attempts. Use application whitelisting to prevent unauthorized code execution on affected systems.
- Monitor affected systems for signs of prior compromise. Before or during patching, review system and security logs for indicators of exploitation. Given the confirmed KEV listing, there is a realistic possibility that unpatched systems may have already been targeted. Conduct forensic analysis if anomalies are detected.
- Establish ongoing patch management practices for this product. Ensure Microsoft security advisories are monitored continuously. Subscribe to vendor notification channels and integrate patch testing and deployment into your organization's vulnerability management lifecycle to prevent future exposure windows.
Technical Details
CVE-2016-0099 is a high-severity vulnerability in Microsoft Windows that compromises the security of affected systems through exploitation of buffer copy without checking size of input ('classic buffer overflow'). The vulnerability exists in the way Microsoft Windows handles certain locally accessible operations, where insufficient validation or improper processing of local input or system operations allows an attacker to trigger the vulnerable condition.
The attack vector is Local (AV:L), meaning the attacker requires local access to the target system. The attack complexity is low complexity (AC:L), indicating that reliable exploitation does not require specialized conditions or preparation beyond having access to the attack vector. The vulnerability requires low-level user privileges (PR:L) and no user interaction (UI:N).
The scope is Unchanged (S:U), indicating the impact is contained within the vulnerable component's own security scope. The combined impact ratings of HIGH/HIGH/HIGH for Confidentiality/Integrity/Availability reflect the high-severity nature of this flaw. The root cause — buffer copy without checking size of input ('classic buffer overflow') — is a well-documented weakness class with established exploitation techniques, making this vulnerability a reliable target for attackers who have network access or the ability to deliver malicious input to the affected component. Affected products include: microsoft windows 10 1507 (versions: -); microsoft windows 10 1511 (versions: -); microsoft windows 7 (versions: -); microsoft windows 8.1 (versions: -).
Frequently Asked Questions
Is CVE-2016-0099 actively exploited?
Yes, CVE-2016-0099 is confirmed to be actively exploited in the wild. It was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on 2022-03-03, which requires evidence of active exploitation before a vulnerability can be listed. Furthermore, CISA has confirmed an association between this vulnerability and ransomware campaigns, indicating that threat actors are using it as part of financially motivated attacks. The EPSS score of 90.4% (99.60th percentile) further underscores the high likelihood of ongoing exploitation activity. Organizations should treat this as an urgent security issue requiring immediate attention.
What products are affected by CVE-2016-0099?
CVE-2016-0099 affects Microsoft Windows. Specifically, the following product versions have been identified as vulnerable: microsoft windows 10 1507 (versions: -); microsoft windows 10 1511 (versions: -); microsoft windows 7 (versions: -); microsoft windows 8.1 (versions: -); microsoft windows server 2008 (versions: -; r2); microsoft windows server 2012 (versions: -; r2). Organizations should conduct a thorough inventory of their environments to identify all deployments of the affected software. Both production systems and development or staging environments should be included in this assessment, as any unpatched instance represents a potential entry point for attackers.
How do I fix CVE-2016-0099?
Apply the security update provided by Microsoft according to their official advisory. The vendor advisory is available at: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-032. Ensure all instances of the affected product in your environment are updated to a patched version. While deploying patches, implement compensating controls such as network access restrictions and enhanced monitoring to reduce exploitation risk. After remediation, verify that the patch was successfully applied and review system logs for any indicators of prior compromise, as unpatched systems may have been targeted before the fix was deployed.
How severe is CVE-2016-0099?
CVE-2016-0099 is rated HIGH with a CVSS 3.1 base score of 7.8. The vulnerability requires local access to exploit, with low attack complexity, and does not require user interaction. The impact across confidentiality, integrity, and availability is all rated High, meaning successful exploitation can result in complete system compromise. Its inclusion in the CISA KEV catalog with a remediation deadline of 2022-03-24 confirms the real-world severity. The confirmed association with ransomware campaigns adds additional urgency to remediation efforts. The EPSS score of 90.4% places it in the 99.60th percentile for exploitation likelihood.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.