Microsoft Windows 10 Kernel Memory Elevation of Privilege Vulnerability (CVE-2015-6175, MS15-135)
Executive & SecOps Summary
SECOPS ASSESSMENTMicrosoft Windows 10 Gold (initial release versions).
Local attackers can execute arbitrary code in kernel mode via a crafted application, gaining complete control of the affected system.
Apply the official Microsoft security update (MS15-135) or upgrade to the latest Windows 10 cumulative update.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Enable the Windows Update service and install the cumulative security update or force-install the MS15-135 patch using PowerShell.
# Install and import the PSWindowsUpdate module to apply the security patch
Install-Module PSWindowsUpdate -Force -Verbose
Get-WindowsUpdate -KBArticleID KB3119075 -Install -AcceptAll -AutoReboot2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, restrict interactive logon privileges for non-administrative users and enforce AppLocker policies to prevent unauthorized binary execution.
# Restrict execution of untrusted binaries in user-writable directories using AppLocker
# (It is highly recommended to configure AppLocker via Group Policy Object [GPO] in production environments)
Write-Output 'Enforce AppLocker rules to restrict execution from %OSDRIVE%\Users\*\AppData'3. Log Audit & IoC Verification Commands
Verify the current Windows build version and check if the required security update (KB3119075) is installed.
# Check Windows OS build and verify if the MS15-135 patch is installed
Get-WmiObject Win32_OperatingSystem | Select-Object Caption, Version, BuildNumber
Get-HotFix -Id KB3119075Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2015-6175) is an elevation of privilege (EoP) vulnerability that occurs when the Microsoft Windows 10 Gold kernel improperly handles objects in memory. Due to insufficient validation of user-mode inputs by kernel-mode drivers, memory corruption can be triggered, allowing an attacker to bypass kernel-space security boundaries.
2. Exploitation Mechanics & Attack Scenario
To exploit this vulnerability, an attacker must first obtain local access with low-privilege user credentials on the target system. The attacker then executes a specially crafted local application designed to make specific kernel API calls. This application triggers the vulnerable memory management routine, causing memory corruption and allowing the attacker to elevate their process token to SYSTEM privileges.
3. Infrastructure & Business Impact
As this vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, it represents a highly practical threat vector that has been actively exploited in the wild. Successful exploitation allows attackers to disable endpoint security controls, exfiltrate sensitive data, deploy ransomware, or perform lateral movement within enterprise networks.
Official Vendor Advisories & References
The kernel in Microsoft Windows 10 Gold allows local users to gain privileges via a crafted application, aka "Windows Kernel Memory Elevation of Privilege Vulnerability."
Frequently Asked SecOps Questions (CVE-2015-6175)
FAQQ1. How critical is CVE-2015-6175 and is it actively exploited in the wild?
CVE-2015-6175 is rated CVSS 7.8 (HIGH) with a 30-day EPSS exploitation probability of 5.3%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2015-6175?
Primary impacted vendors include microsoft across windows_10. Scope summary: Microsoft Windows 10 Gold (initial release, 32-bit and 64-bit systems)
Q3. What temporary mitigations or workarounds exist for CVE-2015-6175 before patching?
[Mitigation] Apply the official Microsoft security update (MS15-135) or upgrade to the latest Windows 10 cumulative update. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2015-6175
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (microsoft)
View Category →Microsoft Windows Shell Command Injection and Security Feature Bypass (CVE-2026-96951) Advisory
[Affected Scope] All supported versions of Windows OS including Windows 10, 11, and Windows Server.
Windows ALPC Heap-Based Buffer Overflow Privilege Escalation Vulnerability (CVE-2026-85880) Security Advisory
[Affected Scope] Locally authenticated users across Microsoft Windows operating systems
Windows Update Stack Privilege Escalation Vulnerability via Link Following (CVE-2026-81963) Technical Advisory
[Affected Scope] Microsoft Windows operating systems utilizing the Windows Update Stack
Microsoft Active Directory Federation Services (AD FS) Privilege Escalation Vulnerability (CVE-2026-56155) Security Advisory
[Affected Scope] Windows Server environments with Active Directory Federation Services (AD FS) enabled
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.