CVE-2016-7225

MEDIUM

Microsoft Windows 10 - Improper Access Control

Title source: rule

Description

Virtual Hard Disk Driver in Windows 10 Gold, 1511, and 1607 and Windows Server 2016 does not properly restrict access to files, which allows local users to gain privileges via a crafted application, aka "VHD Driver Elevation of Privilege Vulnerability."

Exploits (1)

exploitdb WORKING POC VERIFIED

by Google Security Research · localwindows

https://www.exploit-db.com/exploits/40764

View Code ZIP pw:eip

References (4)

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id/1037248

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/94016

[Exploit, Third Party Advisory] https://www.exploit-db.com/exploits/40764/

[Vendor Advisory] https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-138

Scores

CVSS v3 6.1

EPSS 0.0109

EPSS Percentile 77.7%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Classification

CWE

CWE-284

Status published

Affected Products (5)

microsoft/windows_10

microsoft/windows_10

microsoft/windows_10

microsoft/windows_server_2016

n/a/n/a

Timeline

Published Nov 10, 2016

Tracked Since Feb 18, 2026