CVE-2012-1893

CVE-2012-1893 is a privilege escalation vulnerability affecting multiple versions of Microsoft Windows, including XP, Vista, Windows 7, and Server 2003/2008. The vulnerability resides in the win32k.sys kernel-mode driver, which fails to properly validate callback parameters during the creation of a hook procedure. This flaw allows a local attacker to gain elevated privileges through a specially crafted application. Rated with a CVSS score of 7.2, this vulnerability is considered highly severe, enabling complete compromise of confidentiality, integrity, and availability (C:C/I:C/A:C) with low attack complexity (AC:L) and requiring local access (AV:L). Despite its severity, the EPSS score is very low, indicating a minimal probability of exploitation in the wild. There is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit or ExploitDB. The vulnerability has received no community discussion or media coverage, suggesting a lack of widespread attention or exploitation.