Loading vulnerability…
Win32k Elevation of Privilege Vulnerability
CVE-2016-0167 is a use-after-free vulnerability in the Microsoft Windows Win32k kernel-mode driver, associated with the xxxMNDestroyHandler function. A local user can execute a crafted application to elevate privileges to SYSTEM. Affected platforms include Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold and version 1511. The vulnerability was exploited as a zero-day and has been used by FIN8 and malware including PUNCHBUGGY and Shifu. It is distinct from CVE-2016-0143 and CVE-2016-0165.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation elevates a local attacker's execution privileges to SYSTEM, crossing the Windows user-to-kernel privilege boundary. Exploits exist for both x86 and x64 systems, and the vulnerability has been used in real-world malware operations.
If you can’t patch tonight, do this now.
Use the FireEye-released YARA rules, Snort rules, OpenIOC content, and related detections to hunt for misuse of exploit tools containing CVE-2016-0167 payloads. These measures support detection and compromise assessment rather than replacing the security update. No vulnerability-specific configuration workaround is identified.
Patch, then assume compromise.
Apply the Microsoft security update addressing CVE-2016-0167 on affected Windows systems. Specific update identifiers and fixed build numbers are not available in the supplied information.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.