CVE-2016-3371

MEDIUM

Microsoft Windows - Unauthorized Information Disclosure via Kernel API

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2016-3371. PoCs published by Google Security Research.

AI-analyzed exploit summary This C# PoC exploits CVE-2026-3371 by abusing NtLoadKeyEx to load a registry hive outside the hidden attachment point, allowing privilege escalation via COM moniker manipulation. It demonstrates a local privilege escalation (LPE) by registering a malicious type library that executes when WinLogon is signaled.

Description

The kernel API in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 does not properly enforce permissions, which allows local users to obtain sensitive information via a crafted application, aka "Windows Kernel Elevation of Privilege Vulnerability."

Exploits (1)

exploitdb WORKING POC VERIFIED

by Google Security Research · localwindows

https://www.exploit-db.com/exploits/40429

View Code ZIP pw:eip

This C# PoC exploits CVE-2026-3371 by abusing NtLoadKeyEx to load a registry hive outside the hidden attachment point, allowing privilege escalation via COM moniker manipulation. It demonstrates a local privilege escalation (LPE) by registering a malicious type library that executes when WinLogon is signaled.

Classification

Working Poc 95%

Attack Type

Lpe

Complexity

Moderate

Reliability

Reliable

Target: Windows 10 10586 (32/64) and 8.1 Update 2

Auth required

Prerequisites: Local user access · Ability to compile and execute C# code

MITRE ATT&CK

T1112 - Modify Registry T1548.002 - Bypass User Account Control

devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (4)

Core 4

Core References

Vendor Advisory vendor-advisory x_refsource_ms

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-111

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1036802

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/92814

Exploit, Third Party Advisory exploit x_refsource_exploit-db

https://www.exploit-db.com/exploits/40429/

Scores

CVSS v3 5.5

EPSS 0.4007

EPSS Percentile 98.5%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Details

CWE

CWE-200

Status published

Products (11)

microsoft/windows_10

microsoft/windows_10 1511

microsoft/windows_10 1607

microsoft/windows_7

microsoft/windows_8.1

microsoft/windows_rt_8.1

microsoft/windows_server_2008

microsoft/windows_server_2008 r2 sp1

microsoft/windows_server_2012

microsoft/windows_server_2012 r2

... and 1 more

Published Sep 14, 2016

Tracked Since Feb 18, 2026