CVE-2016-0040 is an Elevation of Privilege vulnerability in the kernel of Microsoft Windows Vista, Windows 7, and Windows Server 2008, allowing local users to gain elevated privileges through a crafted application. With a CVSS score of 7.8 (High) and a FAUCET Risk Score of 100/100, this vulnerability is easily exploitable with low attack complexity and no user interaction, leading to high impact on confidentiality, integrity, and availability. It is actively exploited in the wild, listed in the KEV catalog, and has publicly available exploit code, including a Metasploit module. The vulnerability has garnered significant community attention with 12 mentions and 2 media articles, indicating its widespread awareness and potential threat.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:* | ||
r2CPE matchmatch criteria | cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.