6.1med
CVE-2016-72241 exploit
Virtual Hard Disk Driver in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Wi…
Published 9 y ago · modified 4 mo ago · JSON
CVSS
6.1
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
4.1%
percentile 91%
Public exploits
1
Exploit-DB
Summary
Virtual Hard Disk Driver in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 does not properly restrict access to files, which allows local users to gain privileges via a crafted application, aka "VHD Driver Elevation of Privilege Vulnerability."
Exploit prediction (EPSS)
4.11% probability of exploitation in the next 30 days, higher than 91% of all scored CVEs.
Exploits and detections
- EDB-40765 Microsoft Windows - VHDMP Arbitrary Physical Disk Cloning Privilege Escalation (MS16-138) · local · 2016-11-15
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 6.1 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N |
| NVD | 2.0 | 3.6 | AV:L/AC:L/Au:N/C:P/I:P/A:N |
Classification
- Weakness
- CWE-284 Improper Access Control
References
- securitytracker.com /id/1037248 · vdb-entry, x_refsource_SECTRACK, x_transferred
- docs.microsoft.com /en-us/security-updates/securitybulletins/2016/ms16-138 · vendor-advisory, x_refsource_MS, x_transferred
- securityfocus.com /bid/94017 · vdb-entry, x_refsource_BID, x_transferred
- exploit-db.com /exploits/40765/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
Sources
- CVE List: CVE-2016-7224
- NVD: CVE-2016-7224
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.