CVE-2013-3661

CVE-2013-3661 is a denial-of-service vulnerability in the EPATHOBJ::bFlatten function of win32k.sys, affecting various Microsoft Windows operating systems from XP to Windows 8 and Server 2012. A local attacker can exploit this by crafting a PATHRECORD chain that causes an infinite linked-list traversal, leading to system instability. With a CVSS score of 4.9, it's a low-severity vulnerability requiring local access to achieve a complete denial of service. While not actively exploited in the wild and not on the KEV catalog, public exploit code exists, including a Metasploit module for local privilege escalation, though it has received minimal community discussion or media coverage.