CVE-2016-0073

MEDIUM

Windows Kernel - Local Privilege Escalation via Registry API Call

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2016-0073. PoCs published by Google Security Research.

AI-analyzed exploit summary The provided C# code demonstrates a local privilege escalation (LPE) exploit for CVE-2016-0073, leveraging impersonation token manipulation to create arbitrary registry keys in another user's hive. It uses S4U logon to impersonate a privileged user and exploits the DeviceApi CMApi vulnerability to bypass access checks.

Description

The kernel in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges via a crafted application that makes an API call to access sensitive information in the registry, aka "Windows Kernel Local Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0075.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Google Security Research · localwindows

https://www.exploit-db.com/exploits/40574

View Code ZIP pw:eip

The provided C# code demonstrates a local privilege escalation (LPE) exploit for CVE-2016-0073, leveraging impersonation token manipulation to create arbitrary registry keys in another user's hive. It uses S4U logon to impersonate a privileged user and exploits the DeviceApi CMApi vulnerability to bypass access checks.

Classification

Working Poc 95%

Attack Type

Lpe

Complexity

Complex

Reliability

Racy

Target: Windows 10 10586 (potentially Windows 8.1 Update 2 or Windows 7)

Auth required

Prerequisites: A second user account with administrative privileges · The target user's hive must be loaded (e.g., via runas or fast user switching) · S4U logon capability

MITRE ATT&CK

T1134 - Access Token Manipulation T1068 - Exploitation for Privilege Escalation

devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (3)

Core 3

Core References

Exploit, Third Party Advisory exploit x_refsource_exploit-db

https://www.exploit-db.com/exploits/40574/

Vendor Advisory vendor-advisory x_refsource_ms

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-124

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/93355

Scores

CVSS v3 5.0

EPSS 0.0510

EPSS Percentile 91.3%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Details

CWE

CWE-200

Status published

Products (7)

microsoft/windows_10

microsoft/windows_10 1511

microsoft/windows_10 1607

microsoft/windows_8.1

microsoft/windows_rt_8.1

microsoft/windows_server_2012

microsoft/windows_server_2012 r2

Published Oct 14, 2016

Tracked Since Feb 18, 2026