Microsoft Windows Kernel Stack-Based Buffer Overflow Vulnerability (CVE-2010-4398)
Published In CISA KEV since Sources: CVE.org
What is affected, what to do
Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows local users to gain privileges, and bypass the User Account Control (UAC) feature, via a crafted REG_BINARY value for a SystemDefaultEUDCFont registry key, aka "Driver Improper Interaction with Windows Kernel Vulnerability."
The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.
- Affected
- Microsoft Windows Server 2008
eq r2..r2
- Microsoft Windows Server 2008
Not sure whether and how you are affected? Ask a question about this vulnerability
Metrics
7.8
Priority
XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.
Source: NVD, CVSS v3
7.8
CVSS v3
Severity High on the scale from 0 to 10.
Source: CVE.org
8.7 %
EPSS score
Moderate — model estimates 1-10% exploitation likelihood.
Source: FIRST EPSS, percentile 95.1
Show all metrics
- Severity
- Critical
Priority (0–325)
The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?
Read in glossary- 211.35 Methodology
Exploit maturity
An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.
Read in glossary- actively exploited
XIEM Effective CVSS
XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command.
Read in glossary- 7.8 Methodology
CVSS v3
CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.
Read in glossary- 7.8
EPSS score
The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“.
Read in glossary- 8.7 %
- Moderate — model estimates 1-10% exploitation likelihood.
EPSS percentile
The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking.
Read in glossary- 95.1
- Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
KEV status
The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.
Read in glossary- Actively exploited
- Published
In CISA KEV since
The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.
Read in glossary- CISA assessment (SSVC)
- Exploitation: active · not automatable · Technical impact: total
- Source: CISA Vulnrichment, as of 10 February 2025
CWE
CWE is a catalogue of typical weakness types in software and hardware — such as flawed input validation, unsafe memory handling or poor authentication. Where a CVE names a concrete vulnerability in a concrete product, a CWE describes the underlying class of defect.
Read in glossary- CWE-787
Response and mitigation
Why act now?
Prioritisation rationale
This CVE sits on KEV because it has been a staple of publicly available local-privilege-escalation toolkits (Metasploit modules, assorted post-exploitation payloads) for years and reliably yields SYSTEM — a standard follow-on step after phishing or after a standard-user account is compromised. The vector is purely local and low-complexity, so it adds no perimeter risk, but it gives huge leverage once an attacker has any foothold. For NIS2-scope organisations the priority is highest wherever Windows 7, Server 2003/2008 or 2008 R2 still run in OT networks, production cells or legacy line-of-business stacks — these hosts are typically unpatched and are routinely abused during ransomware preparation phases, even though CISA has not flagged this specific CVE as ransomware-linked. Although all affected OS versions are end-of-life, patch KB2393802 is still available and should be rolled out immediately; schedule migration to Windows 10/11 and Server 2019/2022 in parallel.
Runbook step 1
Immediate response (0-24 h)
- Deploy Microsoft patch MS11-011 (KB2393802) across every affected host — it fixes the stack-based buffer overflow in
win32k.sys(RtlQueryRegistryValues). Target all remaining Windows 7, Vista, XP, Server 2003 and Server 2008/R2 instances first. - Inventory the legacy estate: every affected product is out of mainstream Microsoft support. Run an asset sweep (SCCM/MECM, Nessus, Lansweeper) for these OS versions and flag them as "end-of-life, must migrate".
- Shrink the local attack surface: restrict write ACLs on
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLinkand the EUDC keys (SystemDefaultEUDCFont) to Administrators only; remove standard users. - Suspend interactive logon rights for standard users on multi-user servers (especially Server 2003/2008 RDS/Terminal hosts) until patched — this is a local-only vulnerability, so denying local code execution denies exploitation.
- Where patching is impossible (isolated OT/KRITIS assets): remove the host from the production network, expose it only through an MFA-gated jump host, and record the compensating control in the NIS2 risk register.
- Deploy Microsoft patch MS11-011 (KB2393802) across every affected host — it fixes the stack-based buffer overflow in
Runbook step 2
Mitigation layers
- Application control: enforce AppLocker or WDAC so that standard users can only run signed, allowlisted binaries — a local EoP exploit needs a userland dropper that is then blocked.
- UAC hardening: set
ConsentPromptBehaviorAdmin = 2(Secure Desktop with credential prompt). The CVE bypasses UAC via a kernel primitive, but the extra prompt raises the bar for upstream social-engineering chains. - Network segmentation: place legacy Windows hosts in a dedicated VLAN with strict egress filtering (no outbound Internet, no SMB to production file servers) to cap lateral movement after a successful EoP.
- Enable EDR with kernel-exploit mitigation (Defender for Endpoint, CrowdStrike, SentinelOne); modern agents detect
win32k.sysexploit primitives heuristically, even without a CVE-specific signature. - Turn on registry auditing: apply a SACL to the affected font/EUDC keys so accesses show up as Event ID 4657.
- Least-privilege review: strip local admin rights from end users (LAPS for the remaining admin accounts) so an EoP exploit cannot launch from an already-privileged context.
Runbook step 3
Detection rules
- Sysmon Event ID 13 (RegistryValueSet) where
TargetObjectcontainsSystemDefaultEUDCFontorFontLink\SystemLinkand theDetailspayload is an unusually large REG_BINARY (more than a few KB) — the classic exploit primitive for this CVE. - Windows Security Event ID 4657 (registry value modified) on the keys above with
SubjectUserSidother than SYSTEM/Administrators, raised as high-severity. - Sysmon EID 1 process-create chain: process runs with a standard-user token, child suddenly appears at SYSTEM integrity without any preceding
runas/service start — generic EoP pattern. KQL example:DeviceProcessEvents | where InitiatingProcessIntegrityLevel == "Medium" and ProcessIntegrityLevel == "System". - Cluster Windows Event ID 1001 (Windows Error Reporting) and 41 (unexpected kernel-power shutdown) on legacy hosts — failed kernel exploits typically produce BugCheck 0x3B/0x7E inside
win32k.sys. - EDR telemetry: processes outside known installers calling
NtSetValueKey/RegSetValueExWagainst EUDC font keys. Sigma shape:category: registry_setplusTargetObject|contains: 'EUDCFont'.
- Sysmon Event ID 13 (RegistryValueSet) where
Detection rules
No NEOSEC detection rule is available for this vulnerability yet.
Classification under NIS2 and CRA
Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.
NIS2
NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.
Read in glossary- Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).
CRA
The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.
Read in glossary- Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.
ISO/IEC 27001
ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.
Read in glossary- Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.
Description
Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows local users to gain privileges, and bypass the User Account Control (UAC) feature, via a crafted REG_BINARY value for a SystemDefaultEUDCFont registry key, aka "Driver Improper Interaction with Windows Kernel Vulnerability."
Source: NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)
Vendors and products
Affected operating systems
| Windows | microsoft | windows_7 | — |
| Windows | microsoft | windows_server_2003 | — |
| Windows | microsoft | windows_server_2008 | r2 |
| Windows | microsoft | windows_server_2008 | — |
| Windows | microsoft | windows_vista | — |
| Windows | microsoft | windows_xp | — |
Weakness classes (CWE)
CWE-787Out-of-bounds Write
Base
The product writes data past the end, or before the beginning, of the intended buffer.
Entry at MITRE CWE-787
Public exploit references
Publicly reported proof-of-concepts, exploit modules and detection templates for this vulnerability. NEOSEC links to the original sources only and does not provide any exploit code.
| CISA KEV Catalog | CISA Known Exploited Vulnerability (opens in a new tab)cisa.gov | actively exploited | |
| Reference tagged as exploit | exploit-db.com (opens in a new tab) | PoC (publicly reported)reported, not verified | — |
| Exploit-DB | EDB-ID 15609 (opens in a new tab)exploit-db.com | PoC (publicly reported)reported, not verified | — |
References & sources
- isc.sans.edudiary.html?storyid=9988x_refsource_MISC, Exploit, Issue tracking
- securityfocus.com45045Vulnerability database, x_refsource_BID, Broken link, Third-party advisory, Vulnerability database
- exploit-db.com15609Exploit, x_refsource_EXPLOIT-DB, Exploit, Third-party advisory, Vulnerability database
- nakedsecurity.sophos.com2010/11/25/new-windows-zero-day-flaw-bypasses-uacx_refsource_MISC, Broken link
- support.avaya.comcss/P8/documents/100127248x_refsource_CONFIRM, Third-party advisory
- vupen.comADV-2011-0324Vulnerability database, x_refsource_VUPEN, Broken link
- exploit-db.combypassing-uac-with-user-privilege-under-windows-vista7-mirrorx_refsource_MISC, Broken link, Exploit, Third-party advisory, Vulnerability database
- twitter.commsftsecresponse/statuses/7590788200402945x_refsource_MISC, Not applicable
- docs.microsoft.comMS11-011Vendor advisory, x_refsource_MS, Patch, Vendor advisory
- securitytracker.com1025046Vulnerability database, x_refsource_SECTRACK, Broken link, Third-party advisory, Vulnerability database
- kb.cert.orgVU#529673Third-party advisory, x_refsource_CERT-VN, Third-party advisory, US government resource
- secunia.com42356Third-party advisory, x_refsource_SECUNIA, Broken link, Vendor advisory
- oval.cisecurity.orgoval:org.mitre.oval:def:12162Vulnerability database, signature, x_refsource_OVAL, Broken link
- cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2010-4398government-resource, US government resource
Embed badge
Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.
<a href="https://intel.neosec.eu/en/cve/CVE-2010-4398"><img src="https://intel.neosec.eu/badge/cve/CVE-2010-4398.svg?lang=en" alt="CVE-2010-4398 – NEOSEC Intel" height="20"></a>