CVE-2016-0070

MEDIUM

Microsoft Windows - Unauthorized Registry Information Disclosure via Kernel API

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2016-0070. PoCs published by Google Security Research.

AI-analyzed exploit summary This exploit leverages a memory corruption vulnerability in the Windows kernel's registry hive handling, specifically in the `nt!CmpCheckValueList` function, where a miscalculation leads to an overly large `memmove` operation, causing a crash or potential privilege escalation.

Description

The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges via a crafted application that makes an API call to access sensitive information in the registry, aka "Windows Kernel Local Elevation of Privilege Vulnerability."

Exploits (1)

exploitdb WORKING POC VERIFIED

by Google Security Research · textdoswindows

https://www.exploit-db.com/exploits/40600

View Code ZIP pw:eip

This exploit leverages a memory corruption vulnerability in the Windows kernel's registry hive handling, specifically in the `nt!CmpCheckValueList` function, where a miscalculation leads to an overly large `memmove` operation, causing a crash or potential privilege escalation.

Classification

Working Poc 90%

Attack Type

Dos | Lpe

Complexity

Moderate

Reliability

Reliable

Target: Microsoft Windows 7 (kernel)

No auth needed

Prerequisites: Ability to load a malicious registry hive file via `RegLoadAppKey()`

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation T1499 - Endpoint Denial of Service

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2

Core References

Vendor Advisory vendor-advisory x_refsource_ms

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-124

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/93354

Scores

CVSS v3 5.5

EPSS 0.1149

EPSS Percentile 95.5%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Details

CWE

CWE-200

Status published

Products (11)

microsoft/windows_10

microsoft/windows_10 1511

microsoft/windows_10 1607

microsoft/windows_7

microsoft/windows_8.1

microsoft/windows_rt_8.1

microsoft/windows_server_2008

microsoft/windows_server_2008 r2 sp1

microsoft/windows_server_2012

microsoft/windows_server_2012 r2

... and 1 more

Published Oct 14, 2016

Tracked Since Feb 18, 2026