CVE-2015-0004

Microsoft Windows - Privilege Escalation via User Profile Service Junction Attack

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2015-0004. PoCs published by Google Security Research.

AI-analyzed exploit summary This is a detailed technical analysis of CVE-2015-0004, a privilege escalation vulnerability in the Windows User Profile Service. It explains how the service mishandles impersonation, leading to potential exploitation via directory and registry hive manipulation.

Description

The User Profile Service (aka ProfSvc) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges by conducting a junction attack to load another user's UsrClass.dat registry hive, aka MSRC ID 20674 or "Microsoft User Profile Service Elevation of Privilege Vulnerability."

Exploits (1)

exploitdb WRITEUP VERIFIED

by Google Security Research · textlocalwindows

https://www.exploit-db.com/exploits/35811

View Code ZIP pw:eip

This is a detailed technical analysis of CVE-2015-0004, a privilege escalation vulnerability in the Windows User Profile Service. It explains how the service mishandles impersonation, leading to potential exploitation via directory and registry hive manipulation.

Classification

Writeup 90%

Attack Type

Lpe

Complexity

Moderate

Reliability

Reliable

Target: Windows 8.1 Update (32/64 bit)

Auth required

Prerequisites: User account with login capabilities · Ability to modify registry keys

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation

devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (6)

Core 6

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/71967

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/61927

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/99519

Exploit x_refsource_misc

https://code.google.com/p/google-security-research/issues/detail?id=123

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/99520

Vendor Advisory vendor-advisory x_refsource_ms

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-003

Scores

EPSS 0.0355

EPSS Percentile 87.8%

Details

CWE

CWE-264

Status published

Products (11)

microsoft/windows_7

microsoft/windows_8

microsoft/windows_8.1

microsoft/windows_rt

microsoft/windows_rt_8.1

microsoft/windows_server_2003

microsoft/windows_server_2008

microsoft/windows_server_2008 r2 sp1

microsoft/windows_server_2012

microsoft/windows_server_2012 r2

... and 1 more

Published Jan 13, 2015

Tracked Since Feb 18, 2026