CVE-2016-0151

The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages process tokens, which allows local users to gain privileges via a crafted application, aka "Windows CSRSS Security Feature Bypass Vulnerability."

Score

CVSS 3.1 7.8 High

Status

Analyzed - secure@microsoft.com

Published

2016-04-12

Last modified

2025-10-21

Known exploited (CISA KEV)

since 2022-03-28, action due 2022-04-18: Apply updates per vendor instructions.

Weaknesses

CWE-269

Affected products

• Windows 10 1507 (Microsoft)
• Windows 10 1511 (Microsoft)
• Windows 8.1 (Microsoft)
• Windows Rt 8.1 (Microsoft)
• Windows Server 2012 (Microsoft)

References

• http://www.securitytracker.com/id/1035544
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-048
• https://www.exploit-db.com/exploits/39740/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-0151