Microsoft Windows XP and Server 2003 NDProxy.sys Kernel Local Privilege Escalation (CVE-2013-5065)
Executive & SecOps Summary
SECOPS ASSESSMENTMicrosoft Windows XP SP2/SP3 and Windows Server 2003 SP2 operating systems
Local attackers can execute a crafted application to elevate privileges to SYSTEM level and gain full control of the system
Apply the official MS14-002 security patch or disable the NDProxy service as a temporary workaround
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the official Microsoft MS14-002 security update. Since these operating systems have reached End-of-Life (EOL), it is highly recommended to migrate to a modern, supported version of Windows.
2. Temporary Workaround & Hardening Configuration
If patching is not immediately feasible, you can mitigate the risk by disabling the NDProxy service via the registry. Run the following PowerShell command as an Administrator:
# Disable the NDProxy service by setting its Start value to 4
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\NDProxy' -Name 'Start' -Value 4
# Verify the configuration change
Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\NDProxy' -Name 'Start'3. Log Audit & IoC Verification Commands
Check the version of the NDProxy.sys file on the system to verify if the system is running a vulnerable version:
# Check the NDProxy.sys file version using WMIC in Windows Command Prompt
wmic datafile where "name='C:\\Windows\\System32\\drivers\\
dproxy.sys'" get Version, ManufacturerBlock Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability is an input validation flaw in the NDProxy.sys (NDIS Proxy) driver, which manages telephony and network device interfaces within the Windows kernel. When processing Input/Output Control (IOCTL) requests sent from user-mode, the NDProxy.sys driver fails to properly validate input parameters and pointers, leading to arbitrary memory write or execution flow hijacking in kernel space.
2. Exploitation Mechanics & Attack Scenario
An attacker executes a malicious application with low-privilege user rights on the target system. The application opens a handle to the \\.\NDProxy device and sends a crafted IOCTL request containing malicious payloads. NDProxy.sys processes this input without validation, corrupting kernel-mode function pointers or triggering a null pointer dereference. This allows the attacker's shellcode to execute in kernel mode (Ring 0), ultimately replacing the current process token with a SYSTEM token to achieve local privilege escalation.
3. Infrastructure & Business Impact
This vulnerability has been actively exploited in the wild as a zero-day and is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. If an attacker gains initial access to the network, exploiting this vulnerability on legacy systems (such as Windows Server 2003) allows them to obtain full administrative control, facilitate lateral movement, deploy ransomware, or exfiltrate sensitive business data.
Official Vendor Advisories & References
NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in November 2013.
Frequently Asked SecOps Questions (CVE-2013-5065)
FAQQ1. How critical is CVE-2013-5065 and is it actively exploited in the wild?
CVE-2013-5065 is rated CVSS 7.8 (HIGH) with a 30-day EPSS exploitation probability of 34.6%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2013-5065?
Primary impacted vendors include microsoft across windows_xp, windows_server_2003. Scope summary: Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2
Q3. What temporary mitigations or workarounds exist for CVE-2013-5065 before patching?
[Mitigation] Apply the official MS14-002 security patch or disable the NDProxy service as a temporary workaround Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2013-5065
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (microsoft)
View Category →Microsoft Windows Shell Command Injection and Security Feature Bypass (CVE-2026-96951) Advisory
[Affected Scope] All supported versions of Windows OS including Windows 10, 11, and Windows Server.
Windows ALPC Heap-Based Buffer Overflow Privilege Escalation Vulnerability (CVE-2026-85880) Security Advisory
[Affected Scope] Locally authenticated users across Microsoft Windows operating systems
Windows Update Stack Privilege Escalation Vulnerability via Link Following (CVE-2026-81963) Technical Advisory
[Affected Scope] Microsoft Windows operating systems utilizing the Windows Update Stack
Microsoft Active Directory Federation Services (AD FS) Privilege Escalation Vulnerability (CVE-2026-56155) Security Advisory
[Affected Scope] Windows Server environments with Active Directory Federation Services (AD FS) enabled
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.