CVE-2015-1701: Microsoft Win32k Privilege Escalation Vulnerability

CISA Known Exploited Vulnerabilities

Name

Microsoft Win32k Privilege Escalation Vulnerability

Vendor

Microsoft

Product

Win32k

Added to the catalog

2022-03-03

Due date for US federal agencies

2022-03-24

Weaknesses

CWE-264

Catalog version

2026.10.30

An unspecified vulnerability exists in the Win32k.sys kernel-mode driver in Microsoft Windows Server that allows a local attacker to execute arbitrary code with elevated privileges.

Required action (CISA)

Apply updates per vendor instructions.

Ransomware use: CISA marks this vulnerability as known to be used in ransomware campaigns. CISA does not say which group used it.

Links in CISA's notes

• https://nvd.nist.gov/vuln/detail/CVE-2015-1701

Read on 2026-11-02T23:39:54.475Z under licence cisa-kev-cc0@b0067899 from https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

NVD analysis

Status

Analyzed

Published

2015-04-21T10:59:00.073

Last modified

2026-08-14T05:16:52.667

Weaknesses

NVD-CWE-noinfo

Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in April 2015, aka "Win32k Elevation of Privilege Vulnerability."

References

• http://seclists.org/fulldisclosure/2020/May/34 (Broken Link, Mailing List, Third Party Advisory)
• http://twitter.com/symantec/statuses/590208710527549440 (Press/Media Coverage)
• http://www.securityfocus.com/bid/74245 (Broken Link, Third Party Advisory, VDB Entry)
• http://www.securitytracker.com/id/1032155 (Broken Link, Third Party Advisory, VDB Entry)
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-051 (Patch, Vendor Advisory)
• https://www.exploit-db.com/exploits/37049/ (Exploit, Third Party Advisory, VDB Entry)
• https://www.exploit-db.com/exploits/37367/ (Exploit, Third Party Advisory, VDB Entry)
• https://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html (Third Party Advisory)
• http://seclists.org/fulldisclosure/2020/May/34 (Broken Link, Mailing List, Third Party Advisory)
• http://twitter.com/symantec/statuses/590208710527549440 (Press/Media Coverage)
• http://www.securityfocus.com/bid/74245 (Broken Link, Third Party Advisory, VDB Entry)
• http://www.securitytracker.com/id/1032155 (Broken Link, Third Party Advisory, VDB Entry)
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-051 (Patch, Vendor Advisory)
• https://www.exploit-db.com/exploits/37049/ (Exploit, Third Party Advisory, VDB Entry)
• https://www.exploit-db.com/exploits/37367/ (Exploit, Third Party Advisory, VDB Entry)
• https://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html (Third Party Advisory)
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-1701 (US Government Resource)

This product uses the NVD API but is not endorsed or certified by the NVD.

Read on 2026-11-02T23:41:28.906Z under licence nvd-api-terms-of-use@ff2a5288 from https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2015-1701

CVE record

Assigner

microsoft

State

PUBLISHED

Published

2015-04-21T10:00:00.000Z

Updated

2026-08-14T03:55:38.748Z

Problem types

n/a

Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in April 2015, aka "Win32k Elevation of Privilege Vulnerability."

References

• http://twitter.com/symantec/statuses/590208710527549440
• 37049
• 74245
• MS15-051
• 37367
• https://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html
• 1032155
• 20200514 KL-001-2020-002 : Cellebrite Restricted Desktop Escape and Escalation of User Privilege

Read on 2026-11-03T00:25:53.159Z under licence cve-terms-of-use@81bfa2f3 from https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2015/1xxx/CVE-2015-1701.json