CVE-2013-5065: Microsoft Windows Kernel Privilege Escalation Vulnerability

CISA Known Exploited Vulnerabilities

Name

Microsoft Windows Kernel Privilege Escalation Vulnerability

Vendor

Microsoft

Product

Windows

Added to the catalog

2022-03-03

Due date for US federal agencies

2022-03-24

Weaknesses

CWE-20

Catalog version

2026.10.30

Microsoft Windows NDProxy.sys in the kernel contains an improper input validation vulnerability which can allow a local attacker to escalate privileges.

Required action (CISA)

Apply updates per vendor instructions.

Ransomware use: CISA does not mark known use of this vulnerability in ransomware campaigns.

Links in CISA's notes

• https://nvd.nist.gov/vuln/detail/CVE-2013-5065

Read on 2026-11-02T23:39:54.475Z under licence cisa-kev-cc0@b0067899 from https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

NVD analysis

Status

Analyzed

Published

2013-11-28T00:55:04.677

Last modified

2026-06-16T23:58:19.633

Weaknesses

NVD-CWE-noinfo

NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in November 2013.

References

• http://technet.microsoft.com/security/advisory/2914486 (Patch, Vendor Advisory)
• http://www.fireeye.com/blog/technical/cyber-exploits/2013/11/ms-windows-local-privilege-escalation-zero-day-in-the-wild.html (Broken Link, Not Applicable)
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-002 (Patch, Vendor Advisory)
• https://www.exploit-db.com/exploits/37732/ (Exploit, Third Party Advisory, VDB Entry)
• http://technet.microsoft.com/security/advisory/2914486 (Patch, Vendor Advisory)
• http://www.fireeye.com/blog/technical/cyber-exploits/2013/11/ms-windows-local-privilege-escalation-zero-day-in-the-wild.html (Broken Link, Not Applicable)
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-002 (Patch, Vendor Advisory)
• https://www.exploit-db.com/exploits/37732/ (Exploit, Third Party Advisory, VDB Entry)
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-5065 (US Government Resource)

This product uses the NVD API but is not endorsed or certified by the NVD.

Read on 2026-11-02T23:41:28.906Z under licence nvd-api-terms-of-use@ff2a5288 from https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2013-5065

CVE record

Assigner

microsoft

State

PUBLISHED

Published

2013-11-27T23:00:00.000Z

Updated

2025-10-22T00:05:39.667Z

Problem types

n/a

NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in November 2013.

References

• http://www.fireeye.com/blog/technical/cyber-exploits/2013/11/ms-windows-local-privilege-escalation-zero-day-in-the-wild.html
• 37732
• MS14-002
• http://technet.microsoft.com/security/advisory/2914486

Read on 2026-11-03T00:24:58.449Z under licence cve-terms-of-use@81bfa2f3 from https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2013/5xxx/CVE-2013-5065.json