CVE-2015-0096: Windows Explorer DLL planting untrusted search path privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityThe flaw allows local privilege escalation to full system control and has a very high EPSS score, though it is not in KEV and requires user interaction.

What it is

Windows Explorer loads a DLL from the current working directory when rendering the icon of a crafted shortcut, an untrusted search path flaw (CWE-426). A local attacker who can place a malicious DLL in that directory can have it loaded with Explorer's privileges. The issue affects a broad set of legacy Windows client and server releases.

Impact

An attacker gains code execution at the privilege level of the Explorer process, which on affected systems can mean full system compromise. This allows privilege escalation from a local user to administrator or SYSTEM.

Attack surface

Reached locally by a user opening or viewing a crafted shortcut whose icon triggers DLL loading from the current working directory. No authentication is required, but some user interaction (accessing the shortcut) is needed; the CVSS vector AV:N reflects the delivery of the shortcut rather than remote code execution.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented. EPSS is high (0.70964, 99.37th percentile), indicating elevated predicted exploitation likelihood, but the record contains no public exploit or in-the-wild confirmation.

What to do

• Apply the Microsoft MS15-020 security update for all affected Windows versions.
• Upgrade or retire unsupported platforms such as Windows Server 2003, Vista and Windows RT.
• Disable or restrict WebClient and other services that allow remote DLL placement where feasible.
• Enforce least privilege and application control so users cannot write DLLs into directories used by Explorer.
• Educate users not to open shortcuts from untrusted or downloaded sources.

Detection

• Monitor for DLL files created in user-writable directories that are subsequently loaded by explorer.exe.
• Alert on image loads of unsigned or unexpected DLLs by explorer.exe using Sysmon Event ID 7 or equivalent.
• Hunt for crafted .lnk files with unusual icon paths or embedded references to local DLLs.
• Correlate shortcut file creation with subsequent Explorer process DLL load events.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.