CVE-2016-3251: Windows Win32k GDI kernel-address information disclosure

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

medium priorityThe flaw only leaks kernel addresses with local access and user interaction, but it is a known ASLR-bypass primitive and the record shows a very high EPSS score.

What it is

The GDI component in Windows kernel-mode drivers fails to properly handle objects, allowing a local user to read sensitive kernel-address information through a crafted application. This is an information disclosure flaw (CWE-200) that leaks memory layout details useful for bypassing kernel ASLR in a later exploit.

Impact

An attacker gains kernel memory address information, which weakens ASLR and aids in building reliable kernel exploitation chains. There is no direct code execution, data modification, or denial of service from this flaw alone.

Attack surface

Reached locally by running a crafted application on the affected Windows system; the CVSS vector requires local access (AV:L), low privileges (PR:L), and user interaction (UI:R). No network or remote vector is described.

Exploitation

Not listed in CISA KEV and no reference is tagged as exploit or proof-of-concept; EPSS is high (0.58073, 99th percentile), indicating elevated predicted exploitation activity despite the absence of confirmed public exploit code in this record.

What to do

• Apply Microsoft security bulletin MS16-090 (July 2016) to all affected Windows versions.
• Prioritize patching on Windows 7 SP1, Windows 8.1, Windows Server 2008/2012, and Windows 10 Gold/1511 systems that remain in service.
• Restrict local interactive logon and application execution to trusted users to limit the low-privilege local attack path.
• Retire or isolate unsupported end-of-life platforms (Vista SP2, RT 8.1) that cannot receive current fixes.

Detection

• Monitor for unusual local process creation of unsigned or newly written executables that query GDI/kernel objects.
• Correlate local low-privilege process activity with subsequent kernel exploitation attempts or ASLR-bypass behavior.
• Audit hosts for missing MS16-090 patches via vulnerability or patch-management scanning.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.