CVE-2013-5065
NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local...
NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in November 2013.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in November 2013.
- Record
CVE-2013-5065- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List
NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in November 2013.
- Record
CVE-2013-5065- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
EUVDEUVD-2013-4907
NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in November 2013.
- Record
EUVD-2013-4907- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-gmpw-376j-24w5
NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local...
NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in November 2013.
- Record
GHSA-gmpw-376j-24w5- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
CISA KEV No score
Microsoft Windows Kernel Privilege Escalation Vulnerability
Microsoft Windows NDProxy.sys in the kernel contains an improper input validation vulnerability which can allow a local attacker to escalate privileges.
- Record
CVE-2013-5065- Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | MS14-002 Microsoft Windows ndproxy.sys Local Privilege Escalation | 2013-11-27 |
| Exploit-DB | Microsoft Windows - 'NDPROXY' SYSTEM Privilege Escalation (MS14-002) | 2013-12-03 |
| PoC in GitHub | Friarfukd/RobbinHood | 2013-12-07 |
| Exploit-DB | Microsoft Windows - 'ndproxy.sys' Local Privilege Escalation (Metasploit) | 2013-12-17 |
| Exploit-DB | Microsoft Windows XP SP3 (x86) / 2003 SP2 (x86) - 'NDProxy' Local Privilege Escalation (MS14-002) | 2015-08-07 |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-5065 is a high vulnerability (CVSS 7.8) in Microsoft Windows, published November 27, 2013. CISA lists it as known to be exploited, since March 3, 2022. EUVD reports exploitation since March 3, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 34.7%, the 98th percentile. No source names a fixed version.
References
fireeye.com/blog/technical/cyber-exploits/2013/11/ms-windows-local-privilege-escalation-zero-day-in-the-wild.html
exploit-db.com/exploits/37732
docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-002
technet.microsoft.com/security/advisory/2914486
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-5065
nvd.nist.gov/vuln/detail/CVE-2013-5065
github.com/advisories/GHSA-gmpw-376j-24w5