Loading vulnerability…
Win32k Elevation of Privilege Vulnerability
CVE-2016-7255 is a local privilege-escalation vulnerability in Microsoft Windows Win32k kernel-mode memory handling, involving memory corruption in NtUserSetWindowLongPtr. A local user can execute a crafted application to gain elevated privileges and execute code in kernel mode. Affected releases include Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1 and RT 8.1; Windows Server 2012 Gold and R2; Windows 10 Gold, 1511, and 1607; and Windows Server 2016. The vulnerability has been exploited by APT28, APT32, and multiple crimeware families, including Maze and LockCrypt.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits local privilege escalation and kernel-mode code execution. An observed exploit replaces the current process token with the SYSTEM process token, giving the attacking process SYSTEM privileges. The vulnerability has been used in espionage and ransomware operations.
If you can’t patch tonight, do this now.
Until remediation is complete, restrict local execution of untrusted applications and enforce least privilege so that users and compromised applications do not have administrative access by default. Use application control, endpoint detection and response, and monitoring for abnormal child processes or privilege changes associated with Win32k exploitation. These measures reduce exposure but do not eliminate the vulnerability.
Patch, then assume compromise.
Apply Microsoft vendor security updates addressing CVE-2016-7255 to affected Windows systems. Verify that the vulnerable Win32k components have been patched.
1 exploit validated by Mallory's analysis. Hidden: 3 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.