CVE-2016-7225

MEDIUM

Windows 10 and Windows Server 2016 - Privilege Escalation via VHD Driver

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2016-7225. PoCs published by Google Security Research.

AI-analyzed exploit summary This C# PoC exploits CVE-2016-7225, an arbitrary file deletion vulnerability in the Windows VHDMP driver due to unsafe ZwDeleteFile calls without OBJ_FORCE_ACCESS_CHECK. It abuses symbolic links to redirect deletions to arbitrary files, leading to privilege escalation.

Description

Virtual Hard Disk Driver in Windows 10 Gold, 1511, and 1607 and Windows Server 2016 does not properly restrict access to files, which allows local users to gain privileges via a crafted application, aka "VHD Driver Elevation of Privilege Vulnerability."

Exploits (1)

exploitdb WORKING POC VERIFIED

by Google Security Research · localwindows

https://www.exploit-db.com/exploits/40764

View Code ZIP pw:eip

This C# PoC exploits CVE-2016-7225, an arbitrary file deletion vulnerability in the Windows VHDMP driver due to unsafe ZwDeleteFile calls without OBJ_FORCE_ACCESS_CHECK. It abuses symbolic links to redirect deletions to arbitrary files, leading to privilege escalation.

Classification

Working Poc 95%

Attack Type

Lpe

Complexity

Moderate

Reliability

Reliable

Target: Windows 10 (10586, 14393) VHDMP driver

No auth needed

Prerequisites: Access to the system to create symbolic links and execute the PoC · Target file must exist and be inaccessible to the current user

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation T1222 - File and Directory Permissions Modification

devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (4)

Core 4

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1037248

Vendor Advisory vendor-advisory x_refsource_ms

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-138

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/94016

Exploit, Third Party Advisory exploit x_refsource_exploit-db

https://www.exploit-db.com/exploits/40764/

Scores

CVSS v3 6.1

EPSS 0.0411

EPSS Percentile 89.4%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Details

CWE

CWE-284

Status published

Products (4)

microsoft/windows_10

microsoft/windows_10 1511

microsoft/windows_10 1607

microsoft/windows_server_2016

Published Nov 10, 2016

Tracked Since Feb 18, 2026