CVE-2016-0151: Windows CSRSS token mishandling allows local privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with documented ransomware use, has public exploit code, and carries a very high EPSS score, so exploitation is likely and impact is full privilege escalation.

What it is

The Client-Server Run-time Subsystem (CSRSS) in several Windows versions mishandles process tokens, letting a local user escalate privileges through a crafted application. Microsoft classifies it as a security feature bypass, and the flaw affects Windows 8.1, Windows RT 8.1, Windows Server 2012 Gold and R2, and Windows 10 Gold and 1511.

Impact

An attacker who runs code on the host gains elevated privileges, effectively bypassing the intended security boundary. Because CSRSS is a core system process, successful exploitation undermines the token-based privilege model for the whole session.

Attack surface

The attack is local (AV:L) and requires user interaction (UI:R), meaning the crafted application must be executed on the target machine; no prior authentication or network access is needed beyond getting code to run. The CVSS vector shows no privileges required (PR:N), so any local user context is sufficient.

Exploitation

CVE-2016-0151 is listed in CISA's KEV catalog with known ransomware campaign use, and an Exploit-DB entry exists, indicating public exploit code. EPSS estimates a 30-day exploitation probability of about 63% (99th percentile), so active exploitation should be assumed.

What to do

• Apply the Microsoft MS16-048 security update to all affected Windows versions as the primary fix.
• Restrict execution of untrusted applications and binaries on affected hosts to reduce the user-interaction vector.
• Remove or upgrade end-of-life platforms (Windows 8.1, RT 8.1, Server 2012, Windows 10 1507/1511) that no longer receive security updates.
• Enforce least privilege so standard users cannot run arbitrary local code, and monitor for token-manipulation behavior.
• Treat any host still running these builds as compromised-prone and prioritize it for patching or isolation.

Detection

• Monitor for processes spawning from or manipulating CSRSS-related handles and unexpected token duplication events.
• Alert on execution of known exploit binaries or the Exploit-DB sample (39740) on endpoints.
• Audit Windows security event logs for anomalous privilege escalation or token changes by non-admin users.
• Hunt for suspicious local process creation chains that immediately follow user execution of untrusted files.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.