CVE-2015-6133: Windows library loading flaw allows local privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityLocal privilege escalation to full system control with a high EPSS score, though exploitation requires prior local code execution and no KEV listing exists.

What it is

Microsoft Windows 8, 8.1, RT, Server 2012 Gold/R2, and Windows 10 Gold/1511 mishandle library loading, letting a local user run code with elevated privileges via a crafted application. The flaw is a permissions/access-control weakness in how libraries are resolved, and it matters because it turns local access into full system compromise on unpatched hosts.

Impact

An attacker who can run a crafted application on the target gains complete control of confidentiality, integrity and availability (CVSS 2.0 base 7.2, C:C/I:C/A:C), effectively escalating to administrative or SYSTEM-level privileges.

Attack surface

Reached locally: the vector is AV:L with AC:L and Au:N, so no network exposure and no authentication are required, but the attacker must already be able to execute a crafted application on the machine. No user interaction beyond running that application is implied by the record.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is high (0.66581, 99.25th percentile), indicating elevated predicted exploitation likelihood; references are patch and advisory entries only, with no public exploit tag.

What to do

• Apply the Microsoft MS15-132 security update on all affected Windows 8, 8.1, RT, Server 2012 Gold/R2, and Windows 10 Gold/1511 systems.
• Restrict who can execute untrusted binaries on endpoints and servers, since exploitation requires local code execution.
• Enforce least privilege so standard users cannot run arbitrary crafted applications, and remove unnecessary local admin rights.
• Retire or isolate end-of-life builds (Windows 8, RT Gold, Windows 10 Gold/1511) that no longer receive security fixes.

Detection

• Monitor for unexpected processes loading DLLs from user-writable or non-standard directories, especially around privilege escalation.
• Alert on child processes spawned from user-writable paths that run with elevated or SYSTEM tokens.
• Audit application execution on affected hosts for unsigned or newly appeared binaries in user profile and temp directories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.