CVE-2016-0151: Microsoft Windows CSRSS Security Feature Bypass Vulnerability
First published: Tue Apr 12 2016(Updated: )
The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages process tokens, which allows local users to gain privileges via a crafted application, aka "Windows CSRSS Security Feature Bypass Vulnerability."
Credit: secure@microsoft.com secure@microsoft.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft Client-Server Run-time Subsystem (CSRSS) | ||
| Windows 10 | ||
| Windows 10 | =1511 | |
| Microsoft Windows | ||
| Microsoft Windows RT | ||
| Microsoft Windows Server | ||
| Microsoft Windows Server | =r2 | |
| Microsoft Windows 10 | ||
| Microsoft Windows 10 | ||
| Microsoft Windows | ||
| =r2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2016-0151?
CVE-2016-0151 is rated as important, indicating potential for privilege escalation.
How do I fix CVE-2016-0151?
To fix CVE-2016-0151, apply the latest security updates provided by Microsoft for affected operating systems.
Which systems are affected by CVE-2016-0151?
CVE-2016-0151 affects Microsoft Windows 8.1, Windows 10 versions 1507 and 1511, Windows Server 2012, and Windows RT 8.1.
What types of attacks can exploit CVE-2016-0151?
CVE-2016-0151 can be exploited by local users to gain elevated privileges via a specially crafted application.
Is there a workaround for CVE-2016-0151?
While the main resolution is to apply patches, temporarily restricting user permissions can serve as a workaround for CVE-2016-0151.
- agent/type
- agent/description
- agent/title
- agent/severity
- agent/remedy
- agent/author
- agent/first-publish-date
- exploited/true
- ransomware/true
- collector/cisa-known-exploited
- source/CISA
- agent/software-canonical-lookup
- agent/references
- agent/source
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/weakness
- agent/event
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-cve
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- vendor/microsoft
- canonical/microsoft client-server run-time subsystem (csrss)
- canonical/microsoft windows 10
- canonical/microsoft windows
- canonical/microsoft windows rt
- canonical/microsoft windows server
- version/microsoft windows server/r2
- canonical/windows 10
- version/windows 10/1511