CVE-2016-0165: Microsoft Windows Win32k Kernel Driver Privilege Escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is a KEV-listed local privilege escalation with a public exploit and high EPSS score, but requires local access and user interaction, so it is not remotely exploitable on its own.

What it is

The Windows kernel-mode Win32k driver fails to properly handle objects, letting a local user run a crafted application to gain elevated privileges. It affects a broad set of Windows client and server releases from Vista through Windows 10 1511. Because it yields full system rights, it is a standard post-compromise escalation step.

Impact

An attacker who can already run code on the host gains full privileges (confidentiality, integrity and availability all high), effectively taking over the machine. This enables disabling defenses, persisting, and moving laterally.

Attack surface

Reached locally by executing a crafted application on the target; the CVSS vector is AV:L with PR:N and UI:R, so no prior authentication is needed but some form of user interaction is required to launch the malicious program.

Exploitation

CVE-2016-0165 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2023-06-22), and EPSS gives a 30-day probability of about 13.8 percent (96th percentile); an Exploit-DB entry exists, though no ransomware use is documented.

What to do

• Apply the Microsoft MS16-039 security update on all affected Windows versions; this is the primary fix.
• Prioritize patching internet-facing and high-value endpoints, since the flaw is in the KEV catalog.
• Restrict execution of untrusted binaries and use application allowlisting to block crafted local applications.
• Enforce least privilege so users do not run as administrators, reducing the value of the escalation.
• Monitor for and remove commodity exploit tooling that targets Win32k privilege escalation.

Detection

• Alert on unexpected processes spawning with SYSTEM integrity from user-context parents.
• Monitor for known Win32k exploit binaries or tooling matching Exploit-DB 44480 behavior.
• Track suspicious local privilege escalation attempts via EDR process and token-change telemetry.
• Audit hosts still running unpatched Vista, 7, 8.1, RT 8.1, Server 2008/2012 and Windows 10 1507/1511 builds.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.