VULNERABILITY INTELLIGENCE
CVE-2010-2549
CVSS score7.2 HIGH
EPSS probability5.15%
CISA KEVNot currently listed
Published2010-07-02
Last modified2026-06-16
CVSS vectorAV:L/AC:L/Au:N/C:C/I:C/A:C
Description
Use-after-free vulnerability in the kernel-mode drivers in Microsoft Windows Vista SP1 and SP2 and Server 2008 Gold and SP2 allows local users to gain privileges or cause a denial of service (system crash) by using a large number of calls to the NtUserCheckAccessForIntegrityLevel function to trigger a failure in the LockProcessByClientId function, leading to deletion of an in-use process object, aka "Win32k Reference Count Vulnerability."
Primary references
- secure@microsoft.com
- secure@microsoft.com — Exploit
- secure@microsoft.com — Vendor Advisory
- secure@microsoft.com — Exploit
- secure@microsoft.com — Exploit
- secure@microsoft.com — US Government Resource
- secure@microsoft.com
- secure@microsoft.com
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108 — Exploit
- af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Exploit