CVE-2016-0151 The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages process tokens, which allows local users...
HighCVSS 7.8
EPSS 62.8%
CISA KEV
added 2022-03-28 · due 2022-04-18
Ransomware
Exploited in the wild
PoC
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages process tokens, which allows local users to gain privileges via a crafted application, aka "Windows CSRSS Security Feature Bypass Vulnerability."
CISA Known Exploited Vulnerability
- Date added
- 2022-03-28
- Due date (FCEB)
- 2022-04-18
- Ransomware use
- Known
Required action
Apply updates per vendor instructions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft windows 10 1507 | All versions | No fix listed |
| Microsoft windows 10 1511 | All versions | No fix listed |
| Microsoft windows 8.1 | All versions | No fix listed |
| Microsoft windows rt 8.1 | All versions | No fix listed |
| Microsoft Windows Server 2012 | All versions | No fix listed |
| Microsoft Windows Server 2012 | = r2 | No fix listed |
References
- 1035544 broken-link third-party-advisory vdb-entry
- MS16-048 patch vendor-advisory
- 39740 exploit third-party-advisory vdb-entry
- www.cisa.gov government-resource us-government-resource