CVE-2016-0167: Microsoft Windows Win32k kernel driver privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is a kernel privilege escalation with confirmed exploitation and known ransomware use per CISA KEV, though it requires local access and user interaction and has a moderate EPSS probability.

What it is

The kernel-mode Win32k driver in multiple Windows versions fails to properly handle objects, letting a local user run a crafted application to gain elevated privileges. It is a distinct Win32k elevation-of-privilege flaw from CVE-2016-0143 and CVE-2016-0165, and Microsoft addressed it in MS16-039. Because it is a kernel privilege escalation listed in CISA KEV with known ransomware use, it matters for post-compromise escalation on unpatched hosts.

Impact

An attacker who can run code locally gains full privileges on the host, typically SYSTEM, enabling credential theft, persistence and defense evasion. CISA records known ransomware campaign use, so it can be chained into broader intrusions.

Attack surface

Reached locally by executing a crafted application on an affected Windows system; the CVSS vector is AV:L with UI:R, so the attacker needs local access and some form of user interaction, and no prior privileges (PR:N). No remote or network vector is described.

Exploitation

CISA KEV lists it as exploited, added 2021-11-03 with known ransomware campaign use, and EPSS 30-day probability is about 5.7 percent (92.7th percentile). The reference set contains only patch, vendor advisory and government catalog links, with no public exploit or PoC tags.

What to do

• Apply the MS16-039 security update from Microsoft to all affected Windows versions; this is the primary fix.
• Retire or isolate unsupported platforms such as Windows Vista SP2 and Windows Server 2008 SP2/R2 SP1 that no longer receive updates.
• Restrict local interactive logon and application execution to trusted users, since the flaw requires local code execution.
• Enable exploit protection features such as ASLR, DEP and Control Flow Guard, and block untrusted executables via application control.
• Monitor for and remove commodity malware and ransomware tooling that uses Win32k privilege escalation.

Detection

• Hunt for unexpected processes gaining SYSTEM or high-integrity tokens shortly after user-launched applications, especially on unpatched Windows 7, 8.1, RT 8.1, Server 2008/2012 and Windows 10 1507/1511 hosts.
• Alert on execution of known exploit or ransomware binaries that target Win32k privilege escalation, correlating with CISA KEV guidance.
• Audit patch state for MS16-039 across the affected product list and flag hosts missing the update.
• Review local process creation and token-manipulation telemetry for crafted applications spawning elevated children from medium-integrity parents.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.