CVE-2013-3660: Microsoft Windows win32k EPATHOBJ pointer flaw allows privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityLocal privilege escalation to SYSTEM with public exploit code and KEV listing, though it requires user interaction and affects largely legacy Windows versions.

What it is

The EPATHOBJ::pprFlattenRec function in win32k.sys fails to properly initialize a pointer for the next object in a list, letting a local user gain write access to the PATHRECORD chain. Triggering excessive paged memory consumption followed by many FlattenPath calls corrupts kernel memory and yields elevated privileges. The flaw affects a wide range of then-current Windows client and server releases.

Impact

An attacker who can run code on the host gains kernel-level write access and can escalate from a normal user to SYSTEM, taking full control of the machine.

Attack surface

Reached locally through the Win32k graphics subsystem; the CVSS vector requires user interaction (UI:R) and no privileges (PR:N), so a logged-on user must run crafted code or open a crafted file. No remote or network vector is described.

Exploitation

CVE-2013-3660 is listed in CISA KEV (added 2022-03-28) and has public exploit references (Exploit-DB 25611, Tavis Ormandy disclosure), with EPSS 30-day probability 0.396 at the 98.5th percentile. No ransomware campaign use is documented.

What to do

• Apply Microsoft security update MS13-053 for all affected Windows versions; this is the primary fix.
• Retire or isolate unsupported platforms (Windows XP, Server 2003) that cannot receive current patches.
• Enforce least privilege so users do not run untrusted executables, reducing the local attack surface.
• Use application allowlisting and endpoint controls to block execution of unknown binaries that could trigger the flaw.

Detection

• Monitor for unexpected privilege escalation to SYSTEM from interactive user sessions on affected hosts.
• Alert on processes invoking FlattenPath/EPATHOBJ-related GDI operations at abnormal volume or after large paged-memory consumption.
• Hunt for known public exploit binaries or shellcode matching Exploit-DB 25611 indicators.
• Correlate win32k.sys crash or read-AV events with subsequent SYSTEM-level process creation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.