CVE-2011-1985

HIGH

Microsoft Windows - Privilege Escalation

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2011-1985. PoCs published by KiDebug.

AI-analyzed exploit summary This exploit demonstrates a null pointer dereference vulnerability in the Windows kernel (win32k.sys) via crafted SendMessageCallback or SendNotifyMessage calls, leading to a BSOD on Windows XP SP3 32-bit.

Description

win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly validate user-mode input, which allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via a crafted application, aka "Win32k Null Pointer De-reference Vulnerability."

Exploits (1)

exploitdb WORKING POC VERIFIED
by KiDebug · textdoswindows
https://www.exploit-db.com/exploits/18024

This exploit demonstrates a null pointer dereference vulnerability in the Windows kernel (win32k.sys) via crafted SendMessageCallback or SendNotifyMessage calls, leading to a BSOD on Windows XP SP3 32-bit.

Classification
Working Poc 100%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: Microsoft Windows XP SP3 32-bit
No auth needed
Prerequisites: Windows XP SP3 32-bit system
mistral-large-3 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1026165
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12935

Scores

CVSS v3 7.1
EPSS 0.0239
EPSS Percentile 81.9%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-476
Status published
Products (7)
microsoft/windows_2003_server
microsoft/windows_7 (3 CPE variants)
microsoft/windows_server_2003
microsoft/windows_server_2008 (3 CPE variants)
microsoft/windows_server_2008 r2 (2 CPE variants)
microsoft/windows_vista
microsoft/windows_xp (2 CPE variants)
Published Oct 12, 2011
Tracked Since Feb 18, 2026