CVE-2015-2546: Microsoft Windows Win32k kernel driver memory corruption privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is a KEV-listed, actively exploited local privilege escalation with high CVSS impact, though it requires local access and user interaction and affects largely legacy Windows versions.

What it is

The Windows kernel-mode Win32k driver mishandles memory, allowing a local user to corrupt memory and elevate privileges through a crafted application. It affects a broad set of older Windows client and server releases and is listed in CISA KEV, so it matters for any environment still running those platforms.

Impact

An attacker who can run code locally gains elevated privileges on the host, typically SYSTEM, enabling full control of the machine.

Attack surface

Reached locally by executing a crafted application on the target host; the CVSS vector requires low privileges and user interaction, so some form of local access and a user action are needed.

Exploitation

CISA KEV lists it as exploited in the wild with known ransomware campaign use, and EPSS gives a 30-day probability of about 10.2 percent (95th percentile).

What to do

• Apply the Microsoft MS15-097 security update to all affected Windows versions; this is the primary fix.
• Retire or isolate unsupported end-of-life systems such as Vista, Windows 7, Windows 8/8.1 and Windows RT that cannot be patched.
• Restrict local logon and application execution rights so untrusted users cannot run arbitrary binaries on sensitive hosts.
• Enforce least privilege and application allowlisting to block execution of unknown crafted applications.
• Monitor KEV remediation deadlines and confirm patched status across the estate.

Detection

• Alert on unexpected privilege escalation or SYSTEM-level process creation from user-writable paths.
• Monitor for known Win32k exploitation artifacts and suspicious local process token changes.
• Correlate endpoint telemetry for crafted application execution followed by kernel memory corruption indicators.
• Audit hosts still running affected Windows builds against patch inventory.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.