Vulnerability record · CVE-2013-5065 · published 28 November 2013
CVE-2013-5065: Microsoft Windows NDProxy.sys kernel local privilege escalation
Microsoft · Windows 2003 Server
NDProxy.sys in the Windows kernel on Windows XP SP2/SP3 and Server 2003 SP2 fails to properly validate input, letting a local user escalate privileges via a crafted application. Microsoft confirmed the flaw was exploited in the wild in November 2013, and it remains in CISA's Known Exploited Vulnerabilities catalog. The affected platforms are long past end of support, so unpatched instances are unlikely to receive further fixes.
Description
NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in November 2013.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
high priorityConfirmed in-the-wild exploitation, KEV listing and a public exploit outweigh the local-only vector, though the flaw is confined to end-of-life platforms.
What it is
NDProxy.sys in the Windows kernel on Windows XP SP2/SP3 and Server 2003 SP2 fails to properly validate input, letting a local user escalate privileges via a crafted application. Microsoft confirmed the flaw was exploited in the wild in November 2013, and it remains in CISA's Known Exploited Vulnerabilities catalog. The affected platforms are long past end of support, so unpatched instances are unlikely to receive further fixes.
Impact
An attacker who can run code on the host gains full system privileges, allowing installation of programs, data theft or modification, and creation of accounts with administrative rights. Because it is a kernel flaw, the escalation is complete rather than partial.
Attack surface
Reached locally by executing a crafted application on the target machine; the CVSS vector shows no privileges required but user interaction required, so the victim must run or open the malicious program. No network or remote vector is described.
Exploitation
Exploitation is confirmed: the description states it was exploited in the wild in November 2013, it is listed in CISA KEV (added 2022-03-03), and an Exploit-DB entry exists. EPSS 30-day probability is 0.34893 (98.3rd percentile), indicating high predicted activity.
What to do
- Apply the Microsoft fix referenced in MS14-002 / advisory 2914486; this is the only vendor remedy.
- Retire or isolate Windows XP and Server 2003 SP2 systems, since they no longer receive security updates.
- Restrict who can execute untrusted binaries on remaining legacy hosts and block execution from user-writable paths.
- Run legacy hosts with least-privilege accounts and application allowlisting to reduce the chance a crafted binary runs.
- Monitor for and remove known exploit binaries matching the public Exploit-DB proof of concept.
Detection
- Alert on processes spawning from user-writable directories that then load or interact with NDProxy.sys.
- Monitor for unexpected token or privilege changes to SYSTEM on XP/2003 hosts, especially following execution of a new binary.
- Hunt for known exploit artifacts and hashes associated with the public Exploit-DB proof of concept.
- Correlate local process creation events with subsequent administrative account creation or service installation.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2013-5065 to the Known Exploited Vulnerabilities catalog on 3 March 2022 as "Microsoft Windows Kernel Privilege Escalation Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 24 March 2022.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://technet.microsoft.com/security/advisory/2914486 | PatchVendor Advisory |
| http://www.fireeye.com/blog/technical/cyber-exploits/2013/11/ms-windows-local-privilege-escalation-zero-day-in-the-wild. | Broken LinkNot Applicable |
| https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-002 | PatchVendor Advisory |
| https://www.exploit-db.com/exploits/37732/ | ExploitThird Party AdvisoryVDB Entry |
| http://technet.microsoft.com/security/advisory/2914486 | PatchVendor Advisory |
| http://www.fireeye.com/blog/technical/cyber-exploits/2013/11/ms-windows-local-privilege-escalation-zero-day-in-the-wild. | Broken LinkNot Applicable |
| https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-002 | PatchVendor Advisory |
| https://www.exploit-db.com/exploits/37732/ | ExploitThird Party AdvisoryVDB Entry |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-5065 | US Government Resource |
Track CVE-2013-5065 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2013-5065), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
