CVE-2016-0165
Microsoft Win32k Privilege Escalation Vulnerability
Description
CVE-2016-0165 is a privilege escalation vulnerability in the Win32k kernel-mode driver affecting multiple versions of Microsoft Windows, including Windows Vista SP2, Windows 7 SP1, Windows 8.1, Windows 10, Windows Server 2008, and Windows Server 2012. The vulnerability allows a local attacker to elevate privileges from a standard user to SYSTEM level through a specially crafted application that exploits a flaw in the Win32k graphics subsystem. This is one of three related Win32k elevation of privilege vulnerabilities addressed in Microsoft's April 2016 security bulletin MS16-039, alongside CVE-2016-0143 and CVE-2016-0167. CISA has added CVE-2016-0165 to its Known Exploited Vulnerabilities catalog, and the EPSS score of 11.7% (93rd percentile) indicates a notable probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | - |
| microsoft | windows 10 1511 | All versions |
| microsoft | windows 7 | - |
| microsoft | windows 8.1 | All versions |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows vista | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://www.securitytracker.com/id/1035529(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1035532(Broken Link, Third Party Advisory, VDB Entry)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-039(Patch, Vendor Advisory)
- https://www.exploit-db.com/exploits/44480/(Product, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-0165(US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2016-0165 in the NVD database. The vulnerability is classified as an elevation of privilege flaw in the Win32k kernel-mode driver, which typically involves improper handling of objects in memory, insufficient validation of user-supplied data in kernel mode, or inadequate privilege checks during graphics operations.
Impact Analysis
CVE-2016-0165 is a locally exploitable privilege escalation vulnerability that requires a user to run a crafted application, making user interaction necessary for exploitation. With a CVSS score of 7.8 (High), successful exploitation grants the attacker elevated privileges on the affected Windows system. Confidentiality (High): Once elevated to SYSTEM level, the attacker can access any data on the system, including credentials, encryption keys, and protected files belonging to all users. Integrity (High): SYSTEM-level access enables modification of any file, registry key, or system configuration, including security settings and audit logs. Availability (High): The attacker can disable services, corrupt system files, or render the operating system inoperable. The EPSS score of 11.7% (93rd percentile) reflects a meaningful exploitation probability, and the availability of public exploit code on Exploit-DB lowers the barrier for attackers. Combined with the broad range of affected Windows versions, this vulnerability poses a significant risk in environments where local access is achievable through phishing or other initial access vectors.
Exploit Maturity
Public exploit code is available for CVE-2016-0165 via Exploit-DB entry 44480, providing a working proof-of-concept for the Win32k elevation of privilege attack. CISA has confirmed active exploitation in the wild by adding this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of July 13, 2023. The EPSS score of 11.7% (93rd percentile) indicates that while exploitation is less certain than some critical remote vulnerabilities, it remains significantly more likely than most known vulnerabilities. This vulnerability is related to CVE-2016-0143 and CVE-2016-0167, which are separate Win32k elevation of privilege flaws addressed in the same security bulletin, creating potential for chaining with other local or remote access vulnerabilities.
Remediation
- Apply the Microsoft security update from bulletin MS16-039 immediately. The patch is available through the Microsoft Security Bulletin MS16-039 and addresses this vulnerability along with related Win32k flaws CVE-2016-0143 and CVE-2016-0167.
- Ensure all affected Windows versions are updated: Windows Vista SP2, Windows 7 SP1, Windows 8.1, Windows 10 (builds 1507 and 1511), Windows RT 8.1, Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 (Gold and R2). For systems no longer receiving security updates (e.g., Windows Vista, Windows 7), plan migration to a supported operating system.
- Implement application whitelisting using Windows AppLocker or Windows Defender Application Control (WDAC) to prevent execution of unauthorized applications that could be used to exploit this privilege escalation vulnerability.
- Monitor for privilege escalation indicators in Windows event logs, including unexpected process creation with SYSTEM privileges, unusual Win32k driver activity, and security audit events indicating privilege changes. Deploy endpoint detection and response (EDR) solutions configured to detect kernel-level exploitation techniques.
- Apply the principle of least privilege across all user accounts and ensure standard user accounts are used for daily operations rather than administrator accounts, reducing the starting privilege level available to potential exploit payloads.
Technical Details
CVE-2016-0165 is a privilege escalation vulnerability in the Win32k kernel-mode driver (win32k.sys), which handles Windows graphics subsystem operations including window management, GDI rendering, and user input processing. The flaw occurs when the kernel-mode driver improperly handles objects in memory during graphics operations, allowing a locally running application to corrupt kernel memory and execute code with elevated (SYSTEM) privileges. Attack vector (Local): The attacker must execute a crafted application on the target system, requiring prior local access or the ability to trick a user into running the malicious executable. Attack complexity (Low): Once the malicious application is running, exploitation is straightforward with no special conditions required. User interaction (Required): The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects that a user must launch the crafted application, but no specific privileges are required beforehand. This vulnerability is distinct from but related to CVE-2016-0143 and CVE-2016-0167, which exploit different code paths within the same Win32k driver, all addressed in the same MS16-039 bulletin.
Frequently Asked Questions
Is CVE-2016-0165 being actively exploited?
Yes, CVE-2016-0165 is confirmed to be actively exploited. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of July 13, 2023. Public exploit code is available on Exploit-DB, and the EPSS score of 11.7% (93rd percentile) indicates meaningful ongoing exploitation risk.
What products are affected by CVE-2016-0165?
CVE-2016-0165 affects the Win32k kernel-mode driver across a wide range of Microsoft Windows versions: Windows Vista SP2, Windows 7 SP1, Windows 8.1, Windows RT 8.1, Windows 10 (versions 1507 and 1511), Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 (Gold and R2).
How do I fix CVE-2016-0165?
Apply the security update from Microsoft Security Bulletin MS16-039, which patches this vulnerability along with related Win32k flaws. For systems running end-of-life Windows versions that no longer receive patches, migrate to a currently supported operating system. Additionally, implement application whitelisting to prevent unauthorized executables from running.
How severe is CVE-2016-0165?
CVE-2016-0165 has a CVSS score of 7.8 (High severity) under CVSS v3.1. While it requires local access and user interaction, successful exploitation grants full SYSTEM-level privileges with complete impact on confidentiality, integrity, and availability. Its EPSS score in the 93rd percentile confirms it is more likely to be exploited than most known vulnerabilities.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.