CVE-2016-0151

high-risk
Published 2016-04-12

The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages process tokens, which allows local users to gain privileges via a crafted application, aka "Windows CSRSS Security Feature Bypass Vulnerability."

Do I need to act?

!
44.1% chance of exploitation in next 30 days
EPSS score — higher than 56% of all CVEs
!
CISA KEV: actively exploited in the wild
On the Known Exploited Vulnerabilities catalog — federal agencies must patch
!
1 public exploit available
39740
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.8/10 High
LOCAL / LOW complexity

Affected Products (6)

Affected Vendors

Microsoft

References (7)

Broken Link http://www.securitytracker.com/id/1035544
Patch https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-04...
Exploit https://www.exploit-db.com/exploits/39740/
Broken Link http://www.securitytracker.com/id/1035544
Patch https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-04...
Exploit https://www.exploit-db.com/exploits/39740/
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-...
68
/ 100
high-risk
Severity 24/34 · High
Exploitability 31/34 · Critical
Exposure 13/34 · Low