Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2016-1715: McAfee Application Control driver may crash Windows or elevate rights

CVE-2016-1715 · published 10 years ago

Summary

The swin.sys driver in older 32-bit versions of McAfee Application Control can be triggered by a local user to corrupt memory, causing the system to crash or to gain higher privileges. This happens through a special system call that writes a zero to any kernel memory address. Update to the latest build of McAfee Application Control or apply the vendor's patch to prevent the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
microsoft	windows	All versions `cpe:2.3:o:microsoft:windows:::::::x86:*`
mcafee	application_control	6.1.0 6.1.1 6.1.2 6.1.3 6.2.0 `cpe:2.3:a:mcafee:application_control:6.1.0:::::::*`

Original advisory text

The swin.sys kernel driver in McAfee Application Control (MAC) 6.1.0 before build 706, 6.1.1 before build 404, 6.1.2 before build 449, 6.1.3 before build 441, and 6.2.0 before build 505 on 32-bit Windows platforms allows local users to cause a denial of service (memory corruption and system crash) or gain privileges via a 768 syscall, which triggers a zero to be written to an arbitrary kernel memory location.

References

http://www.zerodayinitiative.com/advisories/ZDI-16-007
https://kc.mcafee.com/corporate/index?page=content&id=SB10145 Patch Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.6 Medium

Exploitation

2% chance of attack within 30 days

Type

CWE-189Numeric Errors

Timeline

Published12 Jan 2016

Updated29 Oct 2026

First seen29 Sep 2026

Sources

CVE-2016-1715 · NVD

Track software like this

Free during beta