Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.5

Windows kernel lets local user gain admin rights

CVE-2016-0070 · published 10 years ago
Summary

The core part of several Windows versions—including Windows 7, 8.1, 10, Vista, Server 2008, Server 2012 and Windows RT—can be tricked by a specially crafted program to give a regular user higher privileges and read protected registry data. This means a malicious app could potentially take control of the computer. Install the latest Windows updates or patches that address this issue as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
microsoft windows_10 1511
1607
cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*
microsoft windows_7 All versions
cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*
microsoft windows_8.1 All versions
cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*
microsoft windows_rt_8.1 All versions
cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*
microsoft windows_server_2008 r2
cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*
microsoft windows_server_2012 r2
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
microsoft windows_vista All versions
cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*
Original advisory text
The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allow...
The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges via a crafted application that makes an API call to access sensitive information in the registry, aka "Windows Kernel Local Elevation of Privilege Vulnerability."
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.5 Medium
Exploitation
11% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published14 Oct 2016
Updated19 Oct 2026
First seen29 Sep 2026
Sources
CVE-2016-0070 · NVD
Track software like this
Free during beta