CVE-2016-7255

HIGH KEV RANSOMWARE

Microsoft Windows - Privilege Escalation

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2016-7255 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021, with confirmed use in ransomware campaigns. EIP tracks 10 public exploits from researchers including Rick Larabee, IOactive, TinySec.

AI-analyzed exploit summary This exploit leverages a Windows kernel vulnerability (CVE-2016-7255) to achieve local privilege escalation by manipulating page table entries and executing shellcode to replace the token of a target process with that of the SYSTEM process.

Description

The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."

Exploits (10)

exploitdb WORKING POC
by Rick Larabee · clocalwindows
https://www.exploit-db.com/exploits/41015

This exploit leverages a Windows kernel vulnerability (CVE-2016-7255) to achieve local privilege escalation by manipulating page table entries and executing shellcode to replace the token of a target process with that of the SYSTEM process.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Microsoft Windows (kernel)
No auth needed
Prerequisites: Local access to the target system · Windows kernel vulnerability (CVE-2016-7255) unpatched
devstral-2 · analyzed Feb 18, 2026 Full analysis →
exploitdb WORKING POC
by IOactive · textlocalwindows
https://www.exploit-db.com/exploits/40823

This is a functional proof-of-concept exploit for CVE-2016-7255, which leverages a side-channel attack to derandomize the Windows 10 kernel's ASLR by measuring memory access times to infer PML4 self-referential entries.

Classification
Working Poc 90%
Attack Type
Info Leak
Complexity
Complex
Reliability
Racy
Target: Windows 10 x64 (with Intel Haswell or newer processors)
No auth needed
Prerequisites: Intel Haswell or newer processor · Windows 10 x64 system · Local execution context
devstral-2 · analyzed Feb 18, 2026 Full analysis →
exploitdb WORKING POC
by TinySec · cdoswindows
https://www.exploit-db.com/exploits/40745

This exploit demonstrates CVE-2016-7255, a local privilege escalation vulnerability in Windows. It manipulates window handles and keyboard inputs to trigger a use-after-free condition, potentially allowing arbitrary code execution.

Classification
Working Poc 90%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Windows (versions affected by CVE-2016-7255)
No auth needed
Prerequisites: Local access to the target system
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 82 stars
by FSecureLABS · local
https://github.com/FSecureLABS/CVE-2016-7255

This repository contains a functional exploit for CVE-2016-7255, a local privilege escalation vulnerability in Windows. The exploit leverages a bit-flip corruption in window objects to achieve arbitrary kernel memory read/write, ultimately stealing the SYSTEM token for privilege escalation.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Microsoft Windows (7, 8, 8.1, 10)
No auth needed
Prerequisites: Local access to a vulnerable Windows system
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 11 stars
by yuvatia · local
https://github.com/yuvatia/page-table-exploitation

This repository contains a functional exploit for CVE-2016-7255, demonstrating privilege escalation via page table manipulation in Windows. The exploit leverages the HackSys Extreme Vulnerable Driver (HEVD) to achieve arbitrary code execution in ring-0.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Windows Kernel (via HackSys Extreme Vulnerable Driver)
No auth needed
Prerequisites: HackSys Extreme Vulnerable Driver installed · Windows environment
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 3 stars
by heh3 · local
https://github.com/heh3/CVE-2016-7255

This repository contains a functional exploit for CVE-2016-7255, a Windows kernel vulnerability that allows local privilege escalation. The exploit leverages page table manipulation to achieve arbitrary kernel memory read/write, ultimately escalating privileges to SYSTEM.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Windows 7 SP1, 8.1, 10 (pre-1607), Server 2012 R2
No auth needed
Prerequisites: Local access to the target system · 64-bit Windows OS
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 1 stars
by bbolmin · local
https://github.com/bbolmin/cve-2016-7255_x86_x64

This repository contains a functional exploit for CVE-2016-7255, a local privilege escalation vulnerability in Windows. The code includes both x86 and x64 implementations that leverage kernel memory manipulation techniques to escalate privileges.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Microsoft Windows (specific versions affected by CVE-2016-7255)
Auth required
Prerequisites: Local access to the target system · Administrative or system-level privileges to execute the exploit
devstral-2 · analyzed Feb 18, 2026 Full analysis →
github WORKING POC
by AmazingOut · cpoc
https://github.com/AmazingOut/CVE_POC/tree/main/CVE-2016-7255

This repository contains a functional proof-of-concept exploit for CVE-2016-7255, a Write What Where vulnerability in Windows 7 x64 SP1. The exploit manipulates window handles and keyboard events to trigger the vulnerability.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Windows 7 x64 SP1
No auth needed
Prerequisites: Windows 7 x64 SP1 environment
devstral-2 · analyzed Feb 27, 2026 Full analysis →
nomisec SUSPICIOUS
by homjxi0e · poc
https://github.com/homjxi0e/CVE-2016-7255

The repository contains no exploit code or technical details, only a vague description of CVE-2016-7255 and a reference to MS16-135. The README lacks depth and includes irrelevant personal information, suggesting it may be a lure.

Classification
Suspicious 90%
Attack Type
Lpe
Complexity
Theoretical
Reliability
Theoretical
Target: Microsoft Windows (multiple versions)
Auth required
Prerequisites: Local access to the target system
devstral-2 · analyzed Feb 18, 2026 Full analysis →
patchapalooza WRITEUP
by Ascotbe · local
https://github.com/Ascotbe/Kernelhub

This repository contains documentation and scripts for generating structured vulnerability information, including CVE listings and README files for various Windows exploits. It does not include actual exploit code for CVE-2016-7255 but provides metadata and organizational tools.

Classification
Writeup 90%
Attack Type
Other
Complexity
Moderate
Reliability
Theoretical
Target: Windows (various versions)
No auth needed
Prerequisites: Access to the repository · Python environment for script execution
devstral-2 · analyzed Feb 23, 2026 Full analysis →

References (12)

Core 12
Core References
Exploit, Third Party Advisory x_refsource_misc
https://github.com/mwrlabs/CVE-2016-7255
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/40823/
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/41015/
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/40745/
Broken Link, Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1037251
Patch, Vendor Advisory vendor-advisory x_refsource_ms
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-135
Broken Link, Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/94064

Scores

CVSS v3 7.8
EPSS 0.8936
EPSS Percentile 99.6%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Details

CISA KEV 2021-11-03
VulnCheck KEV 2016-10-21
InTheWild.io 2016-10-21
ENISA EUVD EUVD-2016-8111
Ransomware Use Confirmed
Status published
Products (12)
microsoft/windows_10_1507
microsoft/windows_10_1511
microsoft/windows_10_1607
microsoft/windows_7
microsoft/windows_8.1
microsoft/windows_rt_8.1
microsoft/windows_server_2008
microsoft/windows_server_2008 r2 sp1
microsoft/windows_server_2012
microsoft/windows_server_2012 r2
... and 2 more
Published Nov 10, 2016
KEV Added Nov 03, 2021
Tracked Since Feb 18, 2026