Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2016-3309: Windows 7 and 10 let attackers gain system rights

CVE-2016-3309 · published 10 years ago · actively exploited

Summary

The core part of Windows in versions 7, 10 (1507, 1511, 1607) can be tricked into mishandling memory objects. This lets a malicious user run code with full system privileges, essentially taking control of the computer. Apply the latest security updates from Microsoft as soon as possible to close the gap.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
microsoft	windows	All versions
microsoft	windows_10_1507	All versions `cpe:2.3:o:microsoft:windows_10_1507:-:::::::*`
microsoft	windows_10_1511	All versions `cpe:2.3:o:microsoft:windows_10_1511:-:::::::*`
microsoft	windows_10_1607	All versions `cpe:2.3:o:microsoft:windows_10_1607:-:::::::*`
microsoft	windows_7	All versions `cpe:2.3:o:microsoft:windows_7:-:sp1::::::`
microsoft	windows_8.1	All versions `cpe:2.3:o:microsoft:windows_8.1:-:::::::*`
microsoft	windows_rt_8.1	All versions `cpe:2.3:o:microsoft:windows_rt_8.1:-:::::::*`
microsoft	windows_server_2008	r2 `cpe:2.3:o:microsoft:windows_server_2008:-:sp2::::::`
microsoft	windows_server_2012	r2 `cpe:2.3:o:microsoft:windows_server_2012:-:::::::*`
microsoft	windows_vista	All versions `cpe:2.3:o:microsoft:windows_vista:-:sp2::::::`

Original advisory text

Microsoft Windows Kernel Privilege Escalation Vulnerability

A privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.

References

http://www.securityfocus.com/bid/92297 Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1036572 Broken Link Third Party Advisory VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-09... Patch Vendor Advisory
https://www.exploit-db.com/exploits/42960/ Broken Link Third Party Advisory VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-... US Government Resource

Fix within

Internet-facing 3 days

and check for signs of compromise

Internal 14 days

Known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

7.8 High

Exploitation

Known exploited

Listed in the CISA KEV catalogue - exploitation confirmed in the wild.

20% chance of attack within 30 days

Timeline

Published9 Aug 2016

Updated22 Oct 2026

First seen6 Mar 2026

Sources

CVE-2016-3309 · CISA KEV

CVE-2016-3309 · NVD

Track software like this

Free during beta