IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key
7.8High KEV Used in ransomware

CVE-2016-0151Microsoft Windows CSRSS Security Feature Bypass Vulnerability

microsoft windows 10 1507; microsoft windows 10 1511; microsoft windows 8.1; microsoft windows rt 8.1 Published: (10 years ago)

Known exploited — Microsoft Windows CSRSS Security Feature Bypass Vulnerability

CISA confirmed this vulnerability is used in real attacks on 28.03.2022. Remediation deadline for US federal agencies: 18.04.2022.

Required action: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2016-0151

Description

The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages process tokens, which allows local users to gain privileges via a crafted application, aka "Windows CSRSS Security Feature Bypass Vulnerability."

Weakness (CWE): CWE-269

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

VendorProductVersions
microsoft windows 10 1507 —
microsoft windows 10 1511 —
microsoft windows 8.1 —
microsoft windows rt 8.1 —
microsoft windows server 2012 r2

References and patches

CPE matches (NVD) (6)
  • cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*

Recent CVEs in the same product — Windows 10

7.0High
CVE-2026-108135

Windows Backup Engine Elevation of Privilege Vulnerability

Microsoft Windows 10 Version 21H2; Microsoft Windows 10 Version 22H2; Microsoft Windows 11 version 23H2; Microsoft Windows 11 Version 23H2

Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.

6.5Medium
CVE-2026-108129

Role: DNS Server Information Disclosure Vulnerability

Microsoft Windows 10 Version 1607; Microsoft Windows 10 Version 1809; Microsoft Windows 10 Version 21H2; Microsoft Windows 10 Version 22H2

Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.

1.1%EPSS