CVE-2015-1701 Microsoft Win32k Privilege Escalation
Local attackers can gain elevated privileges via a crafted application exploiting the Win32k.sys kernel driver in Windows.
- Exploited in the wild
- Since 3 Mar 2022
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2015-1701?
CVE-2015-1701 is a high-severity vulnerability in Microsoft Windows 2003 Server, published on 21 Apr 2015. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in April 2015, aka "Win32k Elevation of Privilege Vulnerability."
Which versions are affected by CVE-2015-1701?
It affects 4 products.
Products include Microsoft Windows 2003 Server, Microsoft Windows 7, Microsoft Windows Server 2008, Microsoft Windows Vista.
How do I fix CVE-2015-1701?
No fix has been published for CVE-2015-1701 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 24 Mar 2022.
Is CVE-2015-1701 being exploited?
Yes. Attackers have exploited CVE-2015-1701 in the wild since at least 3 Mar 2022, including in ransomware campaigns.
Public exploit code: 1 Metasploit module, 2 Exploit-DB entries and 3 proofs of concept on GitHub.
Other vulnerabilities in Microsoft Windows 2003 Server
Sources
Also known as GHSA-rq9p-fw9r-ppg4.