Actively exploited · Published Apr 12, 2016 · Assigned by microsoft

CVE-2016-0151

High 7.8 Exploited Ransomware

In plain English

A high-severity privilege mismanagement in Client-Server Run-time Subsystem (CSRSS) from Microsoft. Attackers are actively exploiting it in the wild (listed by CISA on March 28, 2022). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 62.8% (higher than 99.2% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)62.8%top 0.8% of all CVEs

Exploited in the wildYesCISA KEV since Mar 28, 2022

Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Apr 18, 2022.

Official description

The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages process tokens, which allows local users to gain privileges via a crafted application, aka "Windows CSRSS Security Feature Bypass Vulnerability."

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-269 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

MS16-048 vendor-advisory, x_refsource_MS
1035544 vdb-entry, x_refsource_SECTRACK
39740 exploit, x_refsource_EXPLOIT-DB
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-0151 government-resource