Microsoft Win32k Privilege Escalation Vulnerability (CVE-2014-4113)

What is affected, what to do

win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, as exploited in the wild in October 2014, aka "Win32k.sys Elevation of Privilege Vulnerability."

The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Microsoft Windows Server 2008 eq r2..r2
• Microsoft Windows Server 2012 eq r2..r2

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Deploy Microsoft update MS14-058 (KB3000061) across all affected Windows versions — it patches the win32k.sys flaw. Prioritise Terminal/RDS servers, jump hosts and shared multi-user systems first.
   • Inventory every host still running Windows 7/8/8.1, Server 2003/2008/2008 R2/2012/2012 R2 and Windows RT. End-of-life systems with no available patch (XP, 2003, Vista, RT) must be isolated or decommissioned immediately.
   • Audit local interactive logon rights: any user who can run code locally can escalate to SYSTEM. Strip unnecessary interactive logon permissions, especially on servers.
   • Enable AppLocker or Software Restriction Policies to block execution of unsigned binaries from %TEMP%, %APPDATA% and user download paths — the exploit requires a crafted application to be launched locally.
   • Switch EDR kernel exploit mitigations (token stealing, SMEP bypass) from "audit" to "block" where the product supports it.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: place unpatched legacy hosts into isolated VLANs with no outbound internet and no inbound RDP except via hardened jump hosts.
   • Endpoint hardening: enforce EMET (if still deployed) or Exploit Guard with SEHOP, DEP (AlwaysOn) and ASLR (ForceRelocateImages). Confirm KASLR and SMEP enforcement on Server 2012+ and modern CPUs.
   • IAM/least privilege: remove local admin rights from workstations, roll out LAPS for remaining local accounts, lock service accounts with "Deny log on locally" and "Deny log on through RDS".
   • Attack Surface Reduction: enforce PowerShell Constrained Language Mode on user workstations; block Office macros from the internet via GPO to break the initial-access delivery chain.
   • Mail and web gateway: filter executable attachments and uninspected ISO/LNK/HTA payloads, since the local EoP typically runs after a phishing dropper has landed.
   • For hosts that cannot be patched (Server 2003, Vista, RT): dedicated isolation zone with host-firewall default-deny and application-specific proxy access only.
3. 03

   Runbook step 3

   Detection rules

   • Sysmon EID 1 (Process Create) with parent-child anomalies: unexpected child processes of winlogon.exe, services.exe or lsass.exe launched in a user context that transitions to SYSTEM. Sigma shape: parent_image: *\explorer.exe AND integrity_level: System.
   • Windows Event ID 4672 (Special Privileges Assigned) immediately followed by 4688 (Process Creation) for the same user whose source token is non-administrative — a classic token-theft fingerprint.
   • EDR telemetry for kernel-callback manipulation and TOKEN structure overwrite inside win32k.sys code paths; most modern EDR vendors ship ready-made detections labelled "Win32k EoP" or "Token Stealing".
   • Sysmon EID 7 (Image Load) for unusual DLLs loaded from user-writable paths into medium-integrity processes shortly before that process elevates to high or system integrity.
   • Hunting query (KQL, Defender for Endpoint): DeviceProcessEvents | where InitiatingProcessIntegrityLevel in ("Medium","Low") and ProcessIntegrityLevel == "System" | where InitiatingProcessParentFileName !in ("services.exe","wininit.exe").

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, as exploited in the wild in October 2014, aka "Win32k.sys Elevation of Privilege Vulnerability."

Source: NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Microsoft Microsoft Windows 7
• Microsoft Microsoft Windows 8 Professional Edition
• Microsoft Microsoft Windows 8.1
• Microsoft Microsoft Windows RT Gold
• Microsoft Microsoft Windows RT 8.1
• Microsoft Microsoft Windows Server 2003
• Microsoft Microsoft Windows Server 2008
• Microsoft Microsoft Windows Server 2012
• Microsoft Microsoft Windows Vista Gold on X64

References & sources

• blogs.technet.comb/srd/archive/2014/10/14/accessing-risk-for-the-october-2014-se…x_refsource_CONFIRM, Not applicable, Vendor advisory
• packetstormsecurity.comfiles/131964/Windows-8.0-8.1-x64-TrackPopupMenu-Privilege-Escal…x_refsource_MISC, Exploit, Third-party advisory, Vulnerability database
• secunia.com60970Third-party advisory, x_refsource_SECUNIA, Broken link
• exploit-db.com37064Exploit, x_refsource_EXPLOIT-DB, Exploit, Third-party advisory, Vulnerability database
• securityfocus.com70364Vulnerability database, x_refsource_BID, Broken link, Third-party advisory, Vulnerability database
• osvdb.org113167Vulnerability database, x_refsource_OSVDB, Broken link
• docs.microsoft.comMS14-058Vendor advisory, x_refsource_MS, Patch, Vendor advisory
• exploit-db.com39666Exploit, x_refsource_EXPLOIT-DB, Third-party advisory, Vulnerability database
• exploit-db.com35101Exploit, x_refsource_EXPLOIT-DB, Exploit, Third-party advisory, Vulnerability database
• github.comsam-b/CVE-2014-4113x_refsource_MISC, Third-party advisory
• blog.trendmicro.comtrendlabs-security-intelligence/an-analysis-of-a-windows-kernel…x_refsource_MISC, Exploit, Not applicable
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2014-4113government-resource, US government resource