VULNERABILITY INTELLIGENCE
CVE-2015-2527
CVSS score7.2 HIGH
EPSS probability6.56%
CISA KEVNot currently listed
Published2015-09-09
Last modified2026-06-17
CVSS vectorAV:L/AC:L/Au:N/C:C/I:C/A:C
Description
The process-initialization implementation in win32k.sys in the kernel-mode drivers in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 does not properly constrain impersonation levels, which allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
Primary references
- secure@microsoft.com — Third Party Advisory, VDB Entry
- secure@microsoft.com — Third Party Advisory, VDB Entry
- secure@microsoft.com — Patch, Vendor Advisory
- secure@microsoft.com — Exploit, Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Patch, Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry