CVE-2017-0213: Windows COM Aggregate Marshaler local privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityConfirmed KEV exploitation with ransomware use and very high EPSS, but it requires local access and user interaction, so it is a high-priority escalation flaw rather than a remotely exploitable critical.

What it is

The Windows COM Aggregate Marshaler fails to properly validate caller identity, letting a local attacker run a specially crafted application to gain elevated privileges. It affects a wide range of Windows client and server releases, and the flaw is confirmed as exploited in the wild, making it a serious post-compromise escalation path.

Impact

An attacker who already has a foothold on a host can elevate from a low-privileged account to SYSTEM or administrative rights, enabling full control of the machine.

Attack surface

Reached locally by executing a crafted application on the target host; the CVSS vector requires low privileges and user interaction (UI:R), so some form of local access and a user action are needed.

Exploitation

CISA KEV lists it as exploited with known ransomware campaign use, EPSS is very high (0.84, ~99.7th percentile), and an Exploit-DB entry exists, so working exploits are publicly available.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for all affected Windows versions.
• Prioritize patching internet-facing and high-value endpoints, and verify update status on Windows 7, 8.1, RT 8.1, Server 2008/2012/2016 and Windows 10 builds listed.
• Restrict local interactive logon and application execution to trusted users, and remove unnecessary local admin rights.
• Enable and tune EDR/AV to block known exploit binaries and suspicious COM object instantiation.
• Treat any host with this CVE unpatched as compromised if an attacker had prior access, and hunt for escalation artifacts.

Detection

• Monitor process creation for unexpected child processes spawning from COM-related or Office/browser parents with elevated tokens.
• Alert on execution of known Exploit-DB PoC binaries or hashes tied to CVE-2017-0213.
• Audit Windows event logs for token elevation and new service or scheduled task creation shortly after user-level process activity.
• Track unpatched hosts against the affected Windows build list and flag them for remediation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.