CVE-2016-0151 is a security feature bypass vulnerability in the Client-Server Run-time Subsystem (CSRSS) of Microsoft Windows 8.1, Windows Server 2012, Windows RT 8.1, and Windows 10. This flaw allows a local attacker to gain elevated privileges by mismanaging process tokens through a crafted application. With a CVSS score of 7.8 (High), this vulnerability has a low attack complexity and can lead to high impacts on confidentiality, integrity, and availability. Notably, this CVE is listed in CISA's KEV catalog, indicating active exploitation, including its use in known ransomware campaigns, and public exploit code is available on ExploitDB. Despite its severity and active exploitation, community discussion and media coverage for this vulnerability are minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.