Vulnerability record · CVE-2010-4398 · published 6 December 2010
CVE-2010-4398: Windows win32k.sys RtlQueryRegistryValues stack buffer overflow
Microsoft · Windows 7
A stack-based buffer overflow exists in the RtlQueryRegistryValues function in win32k.sys, reachable through a crafted REG_BINARY value for a SystemDefaultEUDCFont registry key. A local user can corrupt kernel memory to gain privileges and bypass User Account Control on affected Windows versions. The flaw matters because it turns limited local access into full system-level control on unpatched hosts.
Description
Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows local users to gain privileges, and bypass the User Account Control (UAC) feature, via a crafted REG_BINARY value for a SystemDefaultEUDCFont registry key, aka "Driver Improper Interaction with Windows Kernel Vulnerability."
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityIt is in CISA KEV with public exploits and high CVSS impact, but requires local authenticated access and affects only legacy Windows versions.
What it is
A stack-based buffer overflow exists in the RtlQueryRegistryValues function in win32k.sys, reachable through a crafted REG_BINARY value for a SystemDefaultEUDCFont registry key. A local user can corrupt kernel memory to gain privileges and bypass User Account Control on affected Windows versions. The flaw matters because it turns limited local access into full system-level control on unpatched hosts.
Impact
An attacker gains elevated privileges, including UAC bypass, allowing kernel-level code execution and full control of the affected machine. This enables persistence, credential access and further lateral movement from an initially low-privileged local account.
Attack surface
The vulnerability is local, requiring an authenticated user session (CVSS vector AV:L/PR:L/UI:N); no remote network path or user interaction is described. It is reached by writing a crafted registry value that win32k.sys later processes.
Exploitation
CVE-2010-4398 is listed in CISA KEV (added 2022-03-28) and has public exploit references on Exploit-DB, indicating known exploitation. EPSS 30-day probability is about 8.7 percent (94.8th percentile), and no ransomware campaign use is documented.
What to do
- Apply the Microsoft MS11-011 security update on all affected Windows XP, Server 2003, Vista, Server 2008 and Windows 7 systems.
- Retire or isolate unsupported platforms (XP, Server 2003) that cannot receive current patches.
- Restrict local interactive logon and administrative rights so untrusted users cannot run code on sensitive hosts.
- Monitor and restrict write access to SystemDefaultEUDCFont and related registry keys where feasible.
Detection
- Alert on unexpected modifications to the SystemDefaultEUDCFont registry key, especially REG_BINARY values.
- Monitor for local privilege escalation behavior and UAC bypass patterns on legacy Windows hosts.
- Hunt for known public exploit artifacts or tooling associated with this win32k.sys overflow.
- Track unpatched legacy Windows systems in inventory and flag them for remediation.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2010-4398 to the Known Exploited Vulnerabilities catalog on 28 March 2022 as "Microsoft Windows Kernel Stack-Based Buffer Overflow Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 21 April 2022.
Affected products
5 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2010-4398 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2010-4398), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
