Vulnerability record · CVE-2016-0040 · published 10 February 2016
CVE-2016-0040: Microsoft Windows Kernel Local Privilege Escalation
Microsoft · Windows 7
The Windows kernel on Vista SP2, Server 2008 SP2/R2 SP1 and Windows 7 SP1 fails to properly validate input, letting a local user escalate privileges through a crafted application. It matters because the affected platforms are legacy but still deployed, and the flaw is listed in CISA KEV with a public exploit.
Description
The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows local users to gain privileges via a crafted application, aka "Windows Elevation of Privilege Vulnerability."
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
high priorityConfirmed in-the-wild exploitation (KEV) and a public exploit, but the flaw is local-only and requires user interaction on legacy platforms.
What it is
The Windows kernel on Vista SP2, Server 2008 SP2/R2 SP1 and Windows 7 SP1 fails to properly validate input, letting a local user escalate privileges through a crafted application. It matters because the affected platforms are legacy but still deployed, and the flaw is listed in CISA KEV with a public exploit.
Impact
An attacker who can run code on the host gains full system privileges, enabling persistence, credential theft and further lateral movement.
Attack surface
Reached locally by executing a crafted application on the target host; the CVSS vector requires user interaction (UI:R) and no prior privileges (PR:N). No remote or network vector is described.
Exploitation
CISA KEV lists it as exploited in the wild (added 2022-03-28) and a public Exploit-DB entry exists; EPSS 30-day probability is 0.24467 (97.8th percentile). No ransomware campaign use is recorded.
What to do
- Apply Microsoft security update MS16-014 on all affected Windows Vista, Server 2008 and Windows 7 systems.
- Prioritize patching hosts that still run these end-of-support platforms, or migrate them to supported Windows versions.
- Restrict local interactive logon and application execution rights to reduce the pool of users who can trigger the flaw.
- Monitor for and block execution of untrusted binaries on legacy endpoints via application allowlisting.
Detection
- Alert on unexpected processes gaining SYSTEM integrity level or spawning from non-privileged user contexts.
- Monitor for known exploit artifacts tied to Exploit-DB 44586 and for kernel-level privilege escalation behavior on legacy hosts.
- Audit legacy Windows 7/Vista/Server 2008 systems for missing MS16-014 and track them as high-risk assets.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2016-0040 to the Known Exploited Vulnerabilities catalog on 28 March 2022 as "Microsoft Windows Kernel Privilege Escalation Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 18 April 2022.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://www.securitytracker.com/id/1034985 | Broken LinkThird Party AdvisoryVDB Entry |
| https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-014 | PatchVendor Advisory |
| https://www.exploit-db.com/exploits/44586/ | ExploitThird Party AdvisoryVDB Entry |
| http://www.securitytracker.com/id/1034985 | Broken LinkThird Party AdvisoryVDB Entry |
| https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-014 | PatchVendor Advisory |
| https://www.exploit-db.com/exploits/44586/ | ExploitThird Party AdvisoryVDB Entry |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-0040 | US Government Resource |
Track CVE-2016-0040 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2016-0040), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
