CVE-2013-3661

Microsoft Windows - Denial of Service via EPATHOBJ::bFlatten Path Traversal

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2013-3661. PoCs published by Metasploit, Tavis Ormandy.

AI-analyzed exploit summary This Metasploit module exploits a local privilege escalation vulnerability in Windows (CVE-2013-3660) by leveraging uninitialized data in EPATHOBJ::pprFlattenRec to corrupt memory and escalate privileges to SYSTEM. It includes process migration and payload execution capabilities.

Description

The EPATHOBJ::bFlatten function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT does not check whether linked-list traversal is continually accessing the same list member, which allows local users to cause a denial of service (infinite traversal) via vectors that trigger a crafted PATHRECORD chain.

Exploits (3)

exploitdb WORKING POC VERIFIED
by Metasploit · rubylocalwindows
https://www.exploit-db.com/exploits/26554

This Metasploit module exploits a local privilege escalation vulnerability in Windows (CVE-2013-3660) by leveraging uninitialized data in EPATHOBJ::pprFlattenRec to corrupt memory and escalate privileges to SYSTEM. It includes process migration and payload execution capabilities.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Windows XP SP3, Windows 2003 SP1, Windows 7 SP1
Auth required
Prerequisites: Local access to the target system · Meterpreter session
devstral-2 · analyzed Feb 18, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by Tavis Ormandy · clocalwindows
https://www.exploit-db.com/exploits/25912

This exploit targets a memory corruption vulnerability in the Windows kernel (win32k.sys) via the EPATHOBJ::pprFlattenRec function, allowing local privilege escalation by manipulating PATHRECORD structures through GDI operations like PolyDraw and FlattenPath.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Microsoft Windows (NT/2K/XP/2K3/VISTA/2K8/7/8)
No auth needed
Prerequisites: Local access to the target system · Ability to execute arbitrary code in user mode
devstral-2 · analyzed Feb 18, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by Tavis Ormandy · textdoswindows
https://www.exploit-db.com/exploits/25611

This exploit leverages a race condition in the Windows kernel's EPATHOBJ::bFlatten function to achieve arbitrary memory writes, leading to a SYSTEM privilege escalation. The PoC uses a watchdog thread to patch a compromised linked list while the kernel is stuck in a loop, demonstrating a reliable LPE on Windows 8.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Microsoft Windows (win32k.sys)
No auth needed
Prerequisites: Access to a vulnerable Windows system
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (9)

Core 9
Core References
Exploit, Third Party Advisory exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/25611/
Third Party Advisory mailing-list x_refsource_fulldisc
http://archives.neohapsis.com/archives/fulldisclosure/2013-05/0094.html
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/53435
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/93539
Various Sources x_refsource_misc
http://www.computerworld.com/s/article/9239477
Third Party Advisory mailing-list x_refsource_fulldisc
http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0006.html

Scores

EPSS 0.0439
EPSS Percentile 90.0%

Details

CWE
CWE-22
Status published
Products (9)
microsoft/windows_7 (2 CPE variants)
microsoft/windows_8 (2 CPE variants)
microsoft/windows_rt
microsoft/windows_server_2003
microsoft/windows_server_2008
microsoft/windows_server_2008 r2 sp1
microsoft/windows_server_2012
microsoft/windows_vista
microsoft/windows_xp (2 CPE variants)
Published May 24, 2013
Tracked Since Feb 18, 2026