VULNERABILITY INTELLIGENCE

CVE-2016-0151

CVSS score7.8 HIGH

EPSS probability62.94%

CISA KEVKnown exploited vulnerability

Published2016-04-12

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Known Exploited Vulnerability

Microsoft Windows CSRSS Security Feature Bypass Vulnerability

Vendor / product: Microsoft / Client-Server Run-time Subsystem (CSRSS)

Description

The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages process tokens, which allows local users to gain privileges via a crafted application, aka "Windows CSRSS Security Feature Bypass Vulnerability."

Weakness classification

CWE-269: Improper Privilege Management

Primary references

secure@microsoft.com — Broken Link, Third Party Advisory, VDB Entry
secure@microsoft.com — Patch, Vendor Advisory
secure@microsoft.com — Exploit, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Broken Link, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry
134c704f-9b21-4f2e-91b3-4a467353bcc0 — US Government Resource