CVE-2010-0232: Windows kernel exception handler privilege escalation via NTVDM

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw gives full local privilege escalation, has public exploit code, and is in CISA KEV with a high EPSS score, though it requires an existing local foothold and affects largely legacy platforms.

What it is

The Windows kernel fails to properly validate certain BIOS calls when 16-bit application support is enabled on 32-bit x86 systems. A local user can craft a VDM_TIB structure in the Thread Environment Block and call NtVdmControl to start the NTVDM subsystem, triggering an improperly handled exception in the #GP trap handler (nt!KiTrap0D) that lets them escalate privileges. The flaw affects Windows NT 3.1 through Windows 7, including Windows 2000 SP4, XP SP2/SP3, Server 2003 SP2, Vista Gold/SP1/SP2, and Server 2008 Gold/SP2.

Impact

An attacker who can run code locally gains full system privileges, allowing complete control of the affected host. This is a classic local privilege escalation that can be chained with other access to take over a machine.

Attack surface

Reached locally by executing code on a 32-bit x86 system with 16-bit application support enabled; no network access or user interaction is required, but the attacker must already have a foothold with low privileges (CVSS vector AV:L/PR:L/UI:N).

Exploitation

CVE-2010-0232 is listed in CISA KEV (added 2022-03-03) and has a high EPSS 30-day probability of 0.29253 (98th percentile), and multiple references are tagged as Exploit, indicating public exploit code exists. No ransomware campaign use is documented.

What to do

• Apply the Microsoft security update for MS10-015 (advisory 979682) to all affected Windows versions.
• Upgrade or retire unsupported systems such as Windows 2000, XP, Server 2003, Vista, and Server 2008 that cannot receive current patches.
• Disable 16-bit application support (NTVDM) on 32-bit x86 systems where it is not required.
• Restrict local interactive logon and code execution to trusted users to reduce the pool of accounts that can trigger the flaw.
• Monitor for and block untrusted binaries that call NtVdmControl or manipulate the Thread Environment Block.

Detection

• Monitor process creation for NTVDM.exe spawned by unexpected or untrusted parent processes.
• Alert on suspicious local privilege escalation behavior, such as processes gaining SYSTEM tokens shortly after NTVDM activity.
• Hunt for known public exploit artifacts (for example KiTrap0D-related binaries) on endpoints.
• Audit 32-bit x86 hosts for enabled 16-bit application support and flag systems that do not require it.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.