CVE-2016-7255
Microsoft Win32k Privilege Escalation Vulnerability
Description
CVE-2016-7255 is a HIGH privilege escalation vulnerability affecting the Microsoft Win32k kernel-mode driver, carrying a CVSS 3.1 score of 7.8. The Win32k driver in multiple versions of Microsoft Windows fails to properly handle objects in memory, allowing a local attacker to execute arbitrary code in kernel mode and gain elevated privileges. Affected products include Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 and R2, Windows RT 8.1, Windows 10 (multiple versions), and Windows Server 2016. This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2022-05-03. With an EPSS score of 0.89296 (99.54th percentile), this vulnerability demonstrates very high real-world exploitation probability. This vulnerability was publicly disclosed by Google's Threat Analysis Group before Microsoft released a patch.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | - |
| microsoft | windows 10 1511 | - |
| microsoft | windows 10 1607 | - |
| microsoft | windows 7 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | - |
| microsoft | windows vista | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://blog.trendmicro.com/trendlabs-security-intelligence/one-bit-rule-system-analyzing-cve-2016-7255-exploit-wild/(Broken Link)
- http://packetstormsecurity.com/files/140468/Microsoft-Windows-Kernel-win32k.sys-NtSetWindowLongPtr-Privilege-Escalation.html(Exploit, Third Party Advisory, VDB Entry)
- http://www.securityfocus.com/bid/94064(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1037251(Broken Link, Third Party Advisory, VDB Entry)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-135(Patch, Vendor Advisory)
- https://github.com/mwrlabs/CVE-2016-7255(Exploit, Third Party Advisory)
- https://securingtomorrow.mcafee.com/mcafee-labs/digging-windows-kernel-privilege-escalation-vulnerability-cve-2016-7255/(Broken Link)
- https://security.googleblog.com/2016/10/disclosing-vulnerabilities-to-protect.html(Third Party Advisory)
- https://www.exploit-db.com/exploits/40745/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/40823/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/41015/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-7255(US Government Resource)
Weakness Type
CWE-NVD-noinfo: Insufficient Information
CVE-2016-7255 has no specific CWE classification assigned by NVD. The vulnerability resides in the Win32k kernel-mode driver, which handles window management and GDI operations. The flaw involves improper handling of objects in memory during window management operations, specifically in the NtSetWindowLongPtr function. This type of vulnerability is characteristic of memory corruption issues (typically CWE-119) combined with improper input validation in kernel-mode code.
The Win32k kernel-mode driver has historically been a frequent source of privilege escalation vulnerabilities due to its complexity and the large attack surface it exposes from user-mode applications. Kernel-mode vulnerabilities are particularly dangerous because they allow attackers to bypass all user-mode security controls, including sandboxes, access control lists, and integrity levels.
Impact Analysis
CVE-2016-7255 carries a CVSS 3.1 score of 7.8 (HIGH) with Unchanged Scope.
Confidentiality (HIGH): Successful exploitation grants the attacker kernel-mode execution privileges, enabling access to all data on the affected system, including credentials, encryption keys, and protected system data that is normally inaccessible from user mode.
Integrity (HIGH): With kernel-mode access, an attacker can modify any system data, install rootkits, alter security policies, tamper with audit logs, and create persistent backdoors that survive reboots.
Availability (HIGH): Kernel-mode code execution can result in system instability, blue screen crashes, or deliberate denial of service. An attacker with kernel access can disable security software and render the system inoperable.
Scope Unchanged: The impact is contained within the vulnerable Windows system, though kernel-level access effectively compromises the entire local security boundary.
With an EPSS score of 0.89296 (99.54th percentile), this vulnerability ranks among the most likely to be exploited, particularly in targeted attack chains where it serves as a local privilege escalation step.
Exploit Maturity
CVE-2016-7255 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: This vulnerability was disclosed by Google's Threat Analysis Group in October 2016 as being actively exploited in targeted attacks, ten days before Microsoft released a patch. Multiple public exploits are available, including in Exploit-DB and security research publications. The exploit targets the NtSetWindowLongPtr function in the Win32k driver.
Ransomware association: As of the latest KEV data, no direct ransomware association has been confirmed for CVE-2016-7255. However, it has been used in sophisticated APT campaigns as a privilege escalation component in multi-stage attack chains.
Attack surface: This is a local privilege escalation vulnerability, meaning an attacker must first obtain code execution on the target system (e.g., through phishing, a browser exploit, or another vulnerability). It is commonly chained with remote code execution vulnerabilities to achieve full system compromise.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2022-05-03. All organizations should ensure the MS16-135 security bulletin has been applied across their Windows infrastructure.
Remediation
- Apply vendor patches immediately. Apply updates per vendor instructions. Install the November 2016 Microsoft security update MS16-135 from the Microsoft Security Advisory for all affected Windows versions.
- Verify affected product versions in your environment. Identify all Windows systems running affected versions using vulnerability scanning and asset inventory tools. Prioritize systems that are externally accessible or host sensitive data.
- Implement exploit mitigations. Enable Windows Defender Exploit Guard and configure Attack Surface Reduction (ASR) rules where available. Deploy Enhanced Mitigation Experience Toolkit (EMET) on older Windows versions that support it.
- Review endpoint security configurations. Ensure endpoint detection and response (EDR) tools are configured to detect kernel-mode exploitation attempts and privilege escalation activities.
- Scan for signs of prior exploitation. Review security event logs for unusual Win32k-related crashes, unexpected privilege escalations, or indicators of compromise associated with the APT campaigns that used this exploit.
- Harden the attack chain. Since this is a local privilege escalation vulnerability, focus on preventing initial access vectors (phishing protection, browser hardening, application whitelisting) that would allow an attacker to reach the exploitation stage.
Technical Details
CVE-2016-7255 is a HIGH-severity local privilege escalation vulnerability in the Microsoft Win32k kernel-mode driver. The attack requires local access and user interaction (the user must open a malicious file or application), but the attack complexity is low once these prerequisites are met.
Technical mechanism: The Win32k kernel-mode driver fails to properly handle objects in memory during window management operations. Specifically, the vulnerability lies in the NtSetWindowLongPtr function, which processes window property changes. A specially crafted application can manipulate window objects in a way that triggers a memory corruption condition in kernel mode. By carefully controlling the corrupted memory, an attacker can redirect execution flow to attacker-controlled code running at kernel privilege level (Ring 0).
CVSS 3.1 vector analysis: The vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects an Attack Vector of LOCAL, Attack Complexity of LOW, Privileges Required of NONE, User Interaction of REQUIRED, Scope UNCHANGED, and impact ratings of HIGH across Confidentiality, Integrity, and Availability. The LOCAL attack vector and REQUIRED user interaction reflect the need for the attacker to first gain code execution on the target system.
Frequently Asked Questions
Is CVE-2016-7255 being actively exploited?
Yes, CVE-2016-7255 was disclosed by Google's Threat Analysis Group in October 2016 as being actively exploited in targeted attacks before Microsoft released a patch. It is listed in CISA's Known Exploited Vulnerabilities catalog. Multiple public exploits are available. The EPSS score of 0.89296 (99.54th percentile) confirms very high exploitation likelihood.
Which products are affected by CVE-2016-7255?
Affected products include Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016. Any unpatched Windows system running the affected Win32k driver is vulnerable.
How do I fix CVE-2016-7255?
Apply the MS16-135 security bulletin from Microsoft for all affected Windows versions. Additionally, enable Windows Defender Exploit Guard and Attack Surface Reduction rules where available. Implement endpoint detection tools to monitor for privilege escalation attempts and harden initial access vectors.
How severe is CVE-2016-7255?
CVE-2016-7255 is rated HIGH with a CVSS 3.1 score of 7.8. With an EPSS score of 0.89296 (99.54th percentile), it is among the most exploited privilege escalation vulnerabilities. While it requires local access, it is commonly chained with remote code execution vulnerabilities in multi-stage attacks. CISA required remediation by 2022-05-03.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.