{"id":"CVE-2015-1701","aliases":["EUVD-2015-1831","GHSA-rq9p-fw9r-ppg4"],"status":"published","title":"Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server...","description":"Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in April 2015, aka \"Win32k Elevation of Privilege Vulnerability.\"","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.55923,"percentile":0.99051,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-264"],"published":"2015-04-21T10:00:00Z","modified":"2026-08-14T05:16:52Z","kev":{"date_added":"2022-03-03","due_date":"2022-03-24","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2022-03-03"},{"source":"kev","since":"2022-03-03"}],"exploits":[{"source":"metasploit","id":"exploit/windows/local/ms15_051_client_copy_image","title":"Windows ClientCopyImage Win32k Exploit","type":"exploit","platform":"Windows","date":"2015-05-12","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/windows/local/ms15_051_client_copy_image"},{"source":"pocgithub","id":"hfiref0x/CVE-2015-1701","title":"hfiref0x/CVE-2015-1701","date":"2015-05-12","url":"https://github.com/hfiref0x/CVE-2015-1701"},{"source":"exploitdb","id":"EDB-37049","title":"Microsoft Windows - Local Privilege Escalation (MS15-051)","type":"local","platform":"windows","date":"2015-05-18","verified":true,"url":"https://www.exploit-db.com/exploits/37049"},{"source":"exploitdb","id":"EDB-37367","title":"Microsoft Windows - ClientCopyImage Win32k (MS15-051) (Metasploit)","type":"local","platform":"windows","date":"2015-06-24","verified":true,"url":"https://www.exploit-db.com/exploits/37367"},{"source":"pocgithub","id":"Anonymous-Family/CVE-2015-1701","title":"Anonymous-Family/CVE-2015-1701","date":"2022-03-21","url":"https://github.com/Anonymous-Family/CVE-2015-1701"},{"source":"pocgithub","id":"Anonymous-Family/CVE-2015-1701-download","title":"Anonymous-Family/CVE-2015-1701-download","date":"2022-03-21","url":"https://github.com/Anonymous-Family/CVE-2015-1701-download"}],"products":[{"vendor":"microsoft","product":"win32k"},{"vendor":"microsoft","product":"windows_2003_server"},{"vendor":"microsoft","product":"windows_7"},{"vendor":"microsoft","product":"windows_server_2008"},{"vendor":"microsoft","product":"windows_vista"}],"references":[{"url":"http://twitter.com/symantec/statuses/590208710527549440","tags":["x_refsource_MISC","x_transferred","Press/Media Coverage"]},{"url":"https://www.exploit-db.com/exploits/37049/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/74245","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-051","tags":["vendor-advisory","x_refsource_MS","x_transferred","Patch","Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/37367/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"http://www.securitytracker.com/id/1032155","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://seclists.org/fulldisclosure/2020/May/34","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Broken Link","Mailing List","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-1701","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1701"},{"url":"https://www.exploit-db.com/exploits/37049"},{"url":"https://www.exploit-db.com/exploits/37367"},{"url":"https://github.com/advisories/GHSA-rq9p-fw9r-ppg4"}],"sources":{"cve":[{"id":"CVE-2015-1701","description":"Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in April 2015, aka \"Win32k Elevation of Privilege Vulnerability.\"","status":"published","published":"2015-04-21T10:00:00Z","modified":"2026-08-14T03:55:38.748Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:35:44.046042Z"}],"euvd":[{"id":"EUVD-2015-1831","description":"Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in April 2015, aka \"Win32k Elevation of Privilege Vulnerability.\"","status":"published","published":"2015-04-21T10:00:00Z","modified":"2026-08-14T03:55:38Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"exploited_since":"2022-03-03","updated_at":"2026-11-02T18:01:55.248337Z"}],"ghsa":[{"id":"GHSA-rq9p-fw9r-ppg4","title":"Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server...","description":"Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in April 2015, aka \"Win32k Elevation of Privilege Vulnerability.\"","status":"published","published":"2022-05-13T01:26:34Z","modified":"2025-10-22T00:31:09Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:04:03.556367Z"}],"kev":[{"id":"CVE-2015-1701","title":"Microsoft Win32k Privilege Escalation Vulnerability","description":"An unspecified vulnerability exists in the Win32k.sys kernel-mode driver in Microsoft Windows Server that allows a local attacker to execute arbitrary code with elevated privileges.","cwes":["CWE-264"],"kev":{"date_added":"2022-03-03","due_date":"2022-03-24","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:16.541131Z"}],"nvd":[{"id":"CVE-2015-1701","description":"Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in April 2015, aka \"Win32k Elevation of Privilege Vulnerability.\"","status":"published","published":"2015-04-21T10:59:00.073Z","modified":"2026-08-14T05:16:52.667Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:03:04.095849Z"}]}}