CVE-2015-6128: Windows library loading flaw allows local privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityLocal privilege escalation with full impact, public exploit code, and very high EPSS, though limited to legacy Windows versions and not in KEV.

What it is

Microsoft Windows Vista SP2, Windows Server 2008 SP2/R2 SP1, and Windows 7 SP1 mishandle library loading, letting a local user run a crafted application that loads a malicious library. Because the flaw yields full control of confidentiality, integrity, and availability, it is a privilege-escalation issue on unpatched legacy systems.

Impact

An attacker who can run code locally gains elevated privileges, effectively full control of the affected host. That access can be used to disable defenses, persist, or move laterally.

Attack surface

Reached locally by executing a crafted application on the target machine; the CVSS vector AV:L/AC:L/Au:N indicates no authentication and no user interaction beyond running the attacker's program. No remote or network vector is described.

Exploitation

Not listed in CISA KEV, but EPSS is 0.81886 (99.6th percentile) and an Exploit-DB entry (38918) exists, indicating public exploit code is available.

What to do

• Apply Microsoft security bulletin MS15-132 for the affected Windows versions.
• Upgrade or retire Windows Vista, Windows Server 2008/R2, and Windows 7 SP1, which are past end of support.
• Restrict local logon and execution rights so untrusted users cannot run arbitrary applications.
• Use application control or allowlisting to block untrusted binaries from loading libraries.
• Monitor and harden DLL search order and library loading paths where feasible.

Detection

• Alert on processes loading libraries from user-writable or unusual directories.
• Monitor for unexpected privilege escalation or new high-integrity processes spawned by low-privilege users.
• Hunt for known exploit artifacts or binaries matching Exploit-DB 38918 behavior.
• Review local execution and logon events on legacy Windows hosts for anomalous activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.