Intel

CVE-2016-7255

Microsoft Win32k — Microsoft Win32k Privilege Escalation Vulnerability

criticalRansomwareKEV: actively exploitedPoCEPSS 81%

Description

The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."

Source: CVELISTV5NVDCISA_KEVCVEORG

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2016-7255 is a local privilege escalation in the Win32k kernel-mode driver with a CVSS vector reflecting high impact on integrity and confidentiality at low attack complexity; an EPSS score of 80.97 % (99.6th percentile) confirms it remains one of the most consistently exploited Windows kernel vulnerabilities in active attack chains. In practice it functions as a second-stage component: an attacker first achieves local code execution via a separate vector (browser exploit, phishing payload) and then uses CVE-2016-7255 to obtain SYSTEM privileges and bypass security controls. Organisations most at risk are those running heterogeneous Windows estates with unpatched workstations or terminal servers, or environments where users retain local administrator rights. Although the CISA KEV entry does not carry the known-ransomware-campaign flag, the age of the vulnerability combined with the wide availability of public exploit code makes it a critical remediation priority for any NIS2-scoped organisation still operating Windows builds predating the November 2016 patch cycle.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply the patch now: Microsoft security update MS16-135 (KB3199135) addresses CVE-2016-7255 across all affected Windows versions (Vista SP2, Server 2008/R2, Windows 7 SP1, 8.1, Server 2012/R2, RT 8.1, Windows 10 Gold/1511/1607, Server 2016). Push via WSUS, SCCM, or enforce through Windows Update.
  • Prioritise by exposure: Systems with interactive user logons — terminal servers, VDI hosts, and workstations — must be patched first, since CVE-2016-7255 requires local code execution as a prerequisite for privilege escalation.
  • Isolate unpatched systems: Any system that cannot receive the patch immediately (e.g. unsupported legacy OS) should be moved to a restricted VLAN with outbound connectivity blocked or disconnected from the network entirely.
  • Restrict local administrator rights: Verify that standard users do not hold local admin rights — this significantly raises the bar for exploitation, as the vulnerability requires local access to trigger.
  • Enable audit logging: Activate Windows event logging for privilege use (Event IDs 4672, 4673) on all affected systems and forward to your SIEM immediately.

Runbook · Step 2

Mitigation layers

  • AppLocker / Software Restriction Policies: Block execution of unsigned or unauthorised binaries by standard users — this prevents delivery of the exploit payload that triggers CVE-2016-7255.
  • Credential Guard & Device Guard (Windows 10/Server 2016): Enable virtualisation-based security to reduce the impact of kernel exploits even before the patch is deployed.
  • Least-privilege IAM: Reduce service and user account rights to the minimum required; manage local administrator group membership via LAPS to limit lateral movement after a successful privilege escalation.
  • Network segmentation: Move systems that cannot be patched into isolated segments; restrict outbound connections to known destinations to disrupt post-exploitation C2 communication.
  • EDR policy hardening: Configure your EDR to block or alert on unusual parent-child process chains (e.g. browser → cmd.exe → SYSTEM-context process) that are characteristic of post-exploitation activity.
  • EMET / Windows Exploit Guard: On systems still running EMET (Windows 7/8.1), enable exploit mitigations for win32k.sys; on Windows 10, deploy Exploit Guard with a kernel protection profile.

Runbook · Step 3

Detection rules

  • Windows Event ID 4673 / 4674: Privileged service or object calls originating from unexpected processes — Sigma shape: EventID: 4673 AND ProcessName NOT IN (lsass.exe, services.exe, svchost.exe) with a threshold of > 3 events/minute as an alert.
  • Sysmon Event ID 10 (ProcessAccess): User-mode processes accessing lsass.exe or csrss.exe — KQL snippet: SysmonEvent | where EventID == 10 and TargetImage has_any ("lsass","csrss") and SourceUser !contains "SYSTEM".
  • Sysmon Event ID 1 (ProcessCreate): Anomalous parent-child chains — e.g. explorer.exe or chrome.exe spawning cmd.exe or powershell.exe that subsequently elevates to SYSTEM context.
  • EDR telemetry — token manipulation: Detection of NtAdjustPrivilegesToken or ZwSetInformationThread calls originating from user-mode processes; most enterprise EDR platforms (CrowdStrike, SentinelOne) carry pre-built detections for these syscall patterns.
  • Windows Event ID 7045 / 4697 (service installation): Attackers commonly install persistent kernel-mode services after successful privilege escalation — SPL snippet: index=wineventlog EventCode=7045 | where ServiceType="kernel mode driver" as a high-priority alert.

Metrics

Severity
critical
Priority score
198.76
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
7.8
Source: nvd-v3
CVSS v3
7.8
CVSS v4
—
EPSS percentile
99.6 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
81.0 %
High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
Published
2016-11-10 07:00 UTC
CWE
—

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CVE Modified2026-09-10 04:17 UTC· secure@microsoft.com
    • Reference: http://blog.trendmicro.com/trendlabs-security-intelligence/one-bit-rule-system-analyzing-cve-2016-7255-exploit-wild/
    • Reference: http://packetstormsecurity.com/files/140468/Microsoft-Windows-Kernel-win32k.sys-NtSetWindowLongPtr-Privilege-Escalation.html
    • Reference: http://www.securityfocus.com/bid/94064
    • Reference: http://www.securitytracker.com/id/1037251
  2. CVE Modified2026-09-10 04:17 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • Reference: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-7255
    • Reference: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-7255
    • Reference Type: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-7255 Types: US Government Resource
    • SSVC: {"id":"CVE-2016-7255","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technical… → {"id":"CVE-2016-7255","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technical…
  3. CVE Modified2026-09-10 04:17 UTC· af854a3a-2127-422b-91ae-364da2661108
    • Reference: http://blog.trendmicro.com/trendlabs-security-intelligence/one-bit-rule-system-analyzing-cve-2016-7255-exploit-wild/
    • Reference: http://packetstormsecurity.com/files/140468/Microsoft-Windows-Kernel-win32k.sys-NtSetWindowLongPtr-Privilege-Escalation.html
    • Reference: http://www.securityfocus.com/bid/94064
    • Reference: http://www.securitytracker.com/id/1037251

Affected operating systems

  • windows

    microsoft / windows_10_1507

  • windows

    microsoft / windows_10_1511

  • windows

    microsoft / windows_10_1607

  • windows

    microsoft / windows_7

  • windows

    microsoft / windows_8.1

  • windows

    microsoft / windows_rt_8.1

  • windows

    microsoft / windows_server_2008r2

  • windows

    microsoft / windows_server_2008

  • windows

    microsoft / windows_server_2012r2

  • windows

    microsoft / windows_server_2012

  • windows

    microsoft / windows_server_2016

  • windows

    microsoft / windows_vista

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

IDCVE-2016-7255