CVE-2015-2433

Microsoft Windows 10 - Information Disclosure

Title source: rule

Description

The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to bypass the ASLR protection mechanism via a crafted application, aka "Kernel ASLR Bypass Vulnerability."

Exploits (2)

exploitdb WORKING POC VERIFIED

by Metasploit · rubylocalwindows_x86-64

https://www.exploit-db.com/exploits/38222

View Code ZIP pw:eip

metasploit WORKING POC MANUAL

by Eugene Ching, Mateusz Jurczyk, Cedric Halbronn, juan vazquez · rubypocwin

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/ms15_078_atmfd_bof.rb

View Code ZIP pw:eip

References (4)

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/76213

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id/1033238

[Patch, Vendor Advisory] https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-080

[Exploit, Third Party Advisory, VDB Entry] https://www.exploit-db.com/exploits/38222/

Scores

EPSS 0.1586

EPSS Percentile 94.8%

Details

CWE

CWE-200

Status published

Products (11)

microsoft/windows_10

microsoft/windows_7

microsoft/windows_8

microsoft/windows_8.1

microsoft/windows_rt

microsoft/windows_rt_8.1

microsoft/windows_server_2008

microsoft/windows_server_2008 r2 sp1 (2 CPE variants)

microsoft/windows_server_2012

microsoft/windows_server_2012 r2

... and 1 more

Published Aug 15, 2015

Tracked Since Feb 18, 2026