CVE-2015-2360: Microsoft Windows win32k.sys memory corruption privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is a kernel privilege escalation with known exploitation per CISA KEV, though it requires local access and affects only legacy Windows versions.

What it is

win32k.sys in the Windows kernel-mode drivers mishandles memory, allowing a local user to corrupt memory through a crafted application. The flaw is a buffer overflow/use-after-free class issue that lets a low-privileged local user escalate to kernel-level privileges or crash the system. It affects a broad set of older Windows client and server releases.

Impact

An attacker who can run code locally gains elevated privileges, typically SYSTEM, on the affected host. Alternatively, the same memory corruption can be used to cause a denial of service.

Attack surface

Reached locally by executing a crafted application on the target machine; no user interaction beyond running the program is required, and the attacker needs only low privileges. The CVSS vector lists network access, but the description and flaw type are local privilege escalation.

Exploitation

CVE-2015-2360 is listed in CISA KEV with a 2022-06-15 remediation due date, indicating known exploitation in the wild. EPSS gives a 30-day probability of about 0.15 (96th percentile), and no ransomware campaign use is recorded.

What to do

• Apply the Microsoft MS15-061 security update to all affected Windows versions.
• Prioritize patching of Windows 7, 8, 8.1, RT, Server 2003, 2008, and 2012 systems still in service.
• Restrict local interactive logon and application execution to trusted users where feasible.
• Retire or isolate end-of-life platforms that no longer receive security updates.

Detection

• Monitor for unexpected processes gaining SYSTEM or kernel-level privileges on affected hosts.
• Alert on crashes or bugchecks originating from win32k.sys.
• Track execution of unsigned or newly written binaries by low-privileged users on legacy Windows systems.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.