CVE-2017-0101: Microsoft Windows Transaction Manager Kernel Driver Privilege Escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is in CISA KEV with documented ransomware use and a public exploit, but exploitation requires local access and user interaction, so it is not remotely wormable.

What it is

A memory buffer overflow (CWE-119) in the kernel-mode drivers of the Windows Transaction Manager lets a local user elevate privileges by running a crafted application. Because the flaw sits in kernel-mode code, successful exploitation yields full control of the affected host.

Impact

An attacker who runs the crafted application gains elevated privileges on the local machine, up to kernel-level code execution. That access can be used to disable security controls, persist, or move laterally.

Attack surface

Reached locally by executing a crafted application on the target host; the CVSS vector (AV:L/PR:N/UI:R) indicates no prior privileges are needed but a user must be induced to run or open the crafted file.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2022-03-15 with known ransomware campaign use, and a public Exploit-DB entry (44479) exists; EPSS 30-day probability is 0.575 (99th percentile).

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2017-0101 on all affected Windows versions.
• Prioritize patching of unsupported or legacy systems (Vista SP2, Server 2008/R2, Windows 7 SP1, Windows 8.1, RT 8.1, Windows 10 Gold/1511/1607, Server 2016) since they cannot receive other fixes.
• Restrict execution of untrusted applications and attachments via application allowlisting and email/web download controls.
• Run users with standard (non-administrative) privileges to limit the value of a successful local elevation.
• Monitor and retire end-of-life Windows builds that no longer receive security updates.

Detection

• Alert on unexpected elevation of privilege events (e.g., Windows Security event 4672 or process token changes) originating from user-launched applications.
• Hunt for processes spawning from Office, browsers, or email clients that subsequently load kernel-mode or Transaction Manager-related components.
• Monitor for known public exploit artifacts tied to Exploit-DB 44479 and for anomalous writes to kernel driver paths.
• Correlate local privilege-escalation detections with subsequent ransomware-like behavior such as shadow copy deletion or mass file encryption.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.