CVE-2016-3309: Windows kernel-mode driver local privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is in CISA KEV with documented ransomware use and public exploit code, but exploitation requires local access, which limits remote mass exploitation.

What it is

CVE-2016-3309 is a Win32k elevation of privilege flaw in kernel-mode drivers across multiple Windows versions, including Vista SP2, Server 2008, Windows 7, 8.1, RT 8.1, Server 2012, and Windows 10 Gold through 1607. A local user running a crafted application can gain elevated privileges, making it a useful post-compromise step for attackers already on a host.

Impact

An attacker with local access gains full system privileges, enabling code execution at the highest integrity level, persistence, and defense evasion. Given the CVSS vector (C:H/I:H/A:H), the compromise is complete across confidentiality, integrity, and availability.

Attack surface

Reached locally by running a crafted application on an affected Windows host; the CVSS vector AV:L/PR:L/UI:N indicates low privileges are required and no user interaction beyond executing the attacker's program. No network or remote vector is described.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2022-03-15 with known ransomware campaign use, and EPSS shows a 30-day probability of roughly 20.6 percent (97th percentile). A public Exploit-DB entry (42960) exists, confirming public exploit code is available.

What to do

• Apply the Microsoft MS16-098 security update to all affected Windows versions immediately.
• Prioritize patching of internet-facing and high-value endpoints, and treat unpatched legacy systems (Vista, Server 2008, Windows 7) as urgent due to lack of ongoing support.
• Restrict local interactive logon and application execution to trusted users, and remove unnecessary local admin rights.
• Enable exploit protection features such as DEP, ASLR, and Windows Defender Exploit Guard where supported.
• Monitor for and block known exploit binaries associated with Exploit-DB 42960.

Detection

• Monitor for unexpected processes spawning with SYSTEM integrity from user-writable directories.
• Alert on known exploit artifacts or hashes tied to Exploit-DB 42960 and related Win32k exploit tooling.
• Track suspicious local privilege escalation behavior via Sysmon process creation and token manipulation events.
• Audit for unauthorized local admin account creation or service installation following user-level process execution.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.