{"id":"CVE-2016-7255","aliases":["EUVD-2016-8111","GHSA-6rfx-wjcx-jvgf"],"status":"published","title":"The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1,...","description":"The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allow local users to gain privileges via a crafted application, aka \"Win32k Elevation of Privilege Vulnerability.\"","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-06","score":0.80968,"percentile":0.99633,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-264"],"published":"2016-11-10T06:16:00Z","modified":"2026-09-10T04:17:32Z","kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2021-11-03"},{"source":"kev","since":"2021-11-03"}],"exploits":[{"source":"exploitdb","id":"EDB-40745","title":"Microsoft Windows Kernel - 'win32k' Denial of Service (MS16-135)","type":"dos","platform":"windows","date":"2016-11-09","url":"https://www.exploit-db.com/exploits/40745"},{"source":"exploitdb","id":"EDB-40823","title":"Microsoft Windows Kernel - 'win32k.sys NtSetWindowLongPtr' Local Privilege Escalation (MS16-135) (1)","type":"local","platform":"windows","date":"2016-11-24","url":"https://www.exploit-db.com/exploits/40823"},{"source":"exploitdb","id":"EDB-41015","title":"Microsoft Windows Kernel - 'win32k.sys NtSetWindowLongPtr' Local Privilege Escalation (MS16-135) (2)","type":"local","platform":"windows","date":"2017-01-08","url":"https://www.exploit-db.com/exploits/41015"},{"source":"pocgithub","id":"heh3/CVE-2016-7255","title":"heh3/CVE-2016-7255","date":"2017-01-13","url":"https://github.com/heh3/CVE-2016-7255"},{"source":"pocgithub","id":"FSecureLABS/CVE-2016-7255","title":"FSecureLABS/CVE-2016-7255","date":"2017-03-02","url":"https://github.com/FSecureLABS/CVE-2016-7255"},{"source":"pocgithub","id":"homjxi0e/CVE-2016-7255","title":"homjxi0e/CVE-2016-7255","date":"2017-04-15","url":"https://github.com/homjxi0e/CVE-2016-7255"},{"source":"pocgithub","id":"yuvatia/page-table-exploitation","title":"yuvatia/page-table-exploitation","date":"2018-06-09","url":"https://github.com/yuvatia/page-table-exploitation"},{"source":"pocgithub","id":"bbolmin/cve-2016-7255_x86_x64","title":"bbolmin/cve-2016-7255_x86_x64","date":"2018-09-13","url":"https://github.com/bbolmin/cve-2016-7255_x86_x64"},{"source":"metasploit","id":"exploit/windows/local/cve_2022_21882_win32k","title":"Win32k ConsoleControl Offset Confusion","type":"exploit","platform":"Windows","date":"2021-02-09","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/windows/local/cve_2022_21882_win32k"}],"products":[{"vendor":"microsoft","product":"win32k"},{"vendor":"microsoft","product":"windows_10_1507"},{"vendor":"microsoft","product":"windows_10_1511"},{"vendor":"microsoft","product":"windows_10_1607"},{"vendor":"microsoft","product":"windows_7"},{"vendor":"microsoft","product":"windows_8.1"},{"vendor":"microsoft","product":"windows_rt_8.1"},{"vendor":"microsoft","product":"windows_server_2008"},{"vendor":"microsoft","product":"windows_server_2012"},{"vendor":"microsoft","product":"windows_server_2016"},{"vendor":"microsoft","product":"windows_vista"}],"references":[{"url":"http://packetstormsecurity.com/files/140468/Microsoft-Windows-Kernel-win32k.sys-NtSetWindowLongPtr-Privilege-Escalation.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://github.com/mwrlabs/CVE-2016-7255","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/40823/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/41015/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://securingtomorrow.mcafee.com/mcafee-labs/digging-windows-kernel-privilege-escalation-vulnerability-cve-2016-7255/","tags":["x_refsource_MISC","x_transferred","Broken Link"]},{"url":"https://www.exploit-db.com/exploits/40745/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1037251","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-135","tags":["vendor-advisory","x_refsource_MS","x_transferred","Patch","Vendor Advisory"]},{"url":"http://blog.trendmicro.com/trendlabs-security-intelligence/one-bit-rule-system-analyzing-cve-2016-7255-exploit-wild/","tags":["x_refsource_MISC","x_transferred","Broken Link"]},{"url":"http://www.securityfocus.com/bid/94064","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://security.googleblog.com/2016/10/disclosing-vulnerabilities-to-protect.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-7255","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7255"},{"url":"https://securingtomorrow.mcafee.com/mcafee-labs/digging-windows-kernel-privilege-escalation-vulnerability-cve-2016-7255"},{"url":"https://www.exploit-db.com/exploits/40745"},{"url":"https://www.exploit-db.com/exploits/40823"},{"url":"https://www.exploit-db.com/exploits/41015"},{"url":"http://blog.trendmicro.com/trendlabs-security-intelligence/one-bit-rule-system-analyzing-cve-2016-7255-exploit-wild"},{"url":"https://github.com/advisories/GHSA-6rfx-wjcx-jvgf"}],"sources":{"cve":[{"id":"CVE-2016-7255","description":"The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allow local users to gain privileges via a crafted application, aka \"Win32k Elevation of Privilege Vulnerability.\"","status":"published","published":"2016-11-10T06:16:00Z","modified":"2026-09-10T03:55:16.226Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:33:36.483151Z"}],"euvd":[{"id":"EUVD-2016-8111","description":"The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allow local users to gain privileges via a crafted application, aka \"Win32k Elevation of Privilege Vulnerability.\"","status":"published","published":"2016-11-10T06:16:00Z","modified":"2026-09-10T03:55:16Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"exploited_since":"2021-11-03","updated_at":"2026-11-02T17:28:25.986684Z"}],"ghsa":[{"id":"GHSA-6rfx-wjcx-jvgf","title":"The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1,...","description":"The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allow local users to gain privileges via a crafted application, aka \"Win32k Elevation of Privilege Vulnerability.\"","status":"published","published":"2022-05-14T02:21:54Z","modified":"2025-10-22T00:32:21Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:04:05.344883Z"}],"kev":[{"id":"CVE-2016-7255","title":"Microsoft Win32k Privilege Escalation Vulnerability","description":"Microsoft Win32k kernel-mode driver fails to properly handle objects in memory which allows for privilege escalation. Successful exploitation allows an attacker to run code in kernel mode.","cwes":["CWE-264"],"kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:17.050017Z"}],"nvd":[{"id":"CVE-2016-7255","description":"The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allow local users to gain privileges via a crafted application, aka \"Win32k Elevation of Privilege Vulnerability.\"","status":"published","published":"2016-11-10T07:00:09.46Z","modified":"2026-09-10T04:17:32.4Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:03:32.086916Z"}]}}