CVE-2016-7255: Microsoft Win32k Privilege Escalation Vulnerability

CISA Known Exploited Vulnerabilities

Name

Microsoft Win32k Privilege Escalation Vulnerability

Vendor

Microsoft

Product

Win32k

Added to the catalog

2021-11-03

Due date for US federal agencies

2022-05-03

Weaknesses

CWE-264

Catalog version

2026.10.30

Microsoft Win32k kernel-mode driver fails to properly handle objects in memory which allows for privilege escalation. Successful exploitation allows an attacker to run code in kernel mode.

Required action (CISA)

Apply updates per vendor instructions.

Ransomware use: CISA marks this vulnerability as known to be used in ransomware campaigns. CISA does not say which group used it.

Links in CISA's notes

• https://nvd.nist.gov/vuln/detail/CVE-2016-7255

Read on 2026-11-02T23:39:54.475Z under licence cisa-kev-cc0@b0067899 from https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

NVD analysis

Status

Analyzed

Published

2016-11-10T07:00:09.460

Last modified

2026-09-10T04:17:32.400

Weaknesses

NVD-CWE-noinfo

The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."

References

• http://blog.trendmicro.com/trendlabs-security-intelligence/one-bit-rule-system-analyzing-cve-2016-7255-exploit-wild/ (Broken Link)
• http://packetstormsecurity.com/files/140468/Microsoft-Windows-Kernel-win32k.sys-NtSetWindowLongPtr-Privilege-Escalation.html (Exploit, Third Party Advisory, VDB Entry)
• http://www.securityfocus.com/bid/94064 (Broken Link, Third Party Advisory, VDB Entry)
• http://www.securitytracker.com/id/1037251 (Broken Link, Third Party Advisory, VDB Entry)
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-135 (Patch, Vendor Advisory)
• https://github.com/mwrlabs/CVE-2016-7255 (Exploit, Third Party Advisory)
• https://securingtomorrow.mcafee.com/mcafee-labs/digging-windows-kernel-privilege-escalation-vulnerability-cve-2016-7255/ (Broken Link)
• https://security.googleblog.com/2016/10/disclosing-vulnerabilities-to-protect.html (Third Party Advisory)
• https://www.exploit-db.com/exploits/40745/ (Exploit, Third Party Advisory, VDB Entry)
• https://www.exploit-db.com/exploits/40823/ (Exploit, Third Party Advisory, VDB Entry)
• https://www.exploit-db.com/exploits/41015/ (Exploit, Third Party Advisory, VDB Entry)
• http://blog.trendmicro.com/trendlabs-security-intelligence/one-bit-rule-system-analyzing-cve-2016-7255-exploit-wild/ (Broken Link)
• http://packetstormsecurity.com/files/140468/Microsoft-Windows-Kernel-win32k.sys-NtSetWindowLongPtr-Privilege-Escalation.html (Exploit, Third Party Advisory, VDB Entry)
• http://www.securityfocus.com/bid/94064 (Broken Link, Third Party Advisory, VDB Entry)
• http://www.securitytracker.com/id/1037251 (Broken Link, Third Party Advisory, VDB Entry)
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-135 (Patch, Vendor Advisory)
• https://github.com/mwrlabs/CVE-2016-7255 (Exploit, Third Party Advisory)
• https://securingtomorrow.mcafee.com/mcafee-labs/digging-windows-kernel-privilege-escalation-vulnerability-cve-2016-7255/ (Broken Link)
• https://security.googleblog.com/2016/10/disclosing-vulnerabilities-to-protect.html (Third Party Advisory)
• https://www.exploit-db.com/exploits/40745/ (Exploit, Third Party Advisory, VDB Entry)
• https://www.exploit-db.com/exploits/40823/ (Exploit, Third Party Advisory, VDB Entry)
• https://www.exploit-db.com/exploits/41015/ (Exploit, Third Party Advisory, VDB Entry)
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-7255 (US Government Resource)

This product uses the NVD API but is not endorsed or certified by the NVD.

Read on 2026-11-02T23:41:35.381Z under licence nvd-api-terms-of-use@ff2a5288 from https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2016-7255

CVE record

Assigner

microsoft

State

PUBLISHED

Published

2016-11-10T06:16:00.000Z

Updated

2026-09-10T03:55:16.226Z

Problem types

n/a

The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."

References

• http://packetstormsecurity.com/files/140468/Microsoft-Windows-Kernel-win32k.sys-NtSetWindowLongPtr-Privilege-Escalation.html
• https://github.com/mwrlabs/CVE-2016-7255
• 40823
• 41015
• https://securingtomorrow.mcafee.com/mcafee-labs/digging-windows-kernel-privilege-escalation-vulnerability-cve-2016-7255/
• 40745
• 1037251
• MS16-135
• http://blog.trendmicro.com/trendlabs-security-intelligence/one-bit-rule-system-analyzing-cve-2016-7255-exploit-wild/
• 94064
• https://security.googleblog.com/2016/10/disclosing-vulnerabilities-to-protect.html

Read on 2026-11-03T00:34:04.670Z under licence cve-terms-of-use@81bfa2f3 from https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/7xxx/CVE-2016-7255.json