CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Microsoft Windows Win32k Kernel-Mode Driver Elevation of Privilege Vulnerability (CVE-2020-1054) Analysis and Mitigation Guide
[Affected Scope] Multiple versions of Windows OS, including Windows 7, 8.1, 10, and Windows Server 2008, 2012, 2016, 2019
[Impact] A local attacker can execute arbitrary code in kernel mode (SYSTEM privileges), leading to complete system takeover, unauthorized data access, and program installation
[Mitigation] Apply the official Microsoft security patches immediately and restrict local interactive login privileges for untrusted users
Microsoft Windows Win32k Kernel-Mode Driver Local Privilege Escalation Vulnerability (CVE-2016-3309, MS16-098)
[Affected Scope] Multiple legacy Windows operating systems including Windows Vista SP2, 7 SP1, 8.1, 10, and Windows Server 2008, 2012
[Impact] Local attackers can execute arbitrary code in kernel mode via a crafted application, gaining complete control of the affected system
[Mitigation] Apply the official Microsoft security patch (MS16-098) immediately, and migrate end-of-life operating systems to supported versions
Microsoft Windows Win32k Kernel-Mode Driver Local Privilege Escalation Vulnerability (CVE-2015-2360, MS15-061)
[Affected Scope] Windows Server 2003/2008/2012, Windows Vista, Windows 7, Windows 8/8.1, and Windows RT systems
[Impact] Local attackers can execute a crafted application to gain elevated SYSTEM privileges or cause a denial of service (memory corruption)
[Mitigation] Immediately apply the Microsoft official security patch (MS15-061) and restrict local execution privileges on unpatched assets
Microsoft Windows win32k.sys Kernel-Mode Driver Local Privilege Escalation (CVE-2015-1701, MS15-051)
[Affected Scope] Microsoft Windows Server 2003 SP2, Windows Vista SP2, and Server 2008 SP2.
[Impact] Local attackers can execute a specially crafted application to elevate privileges to SYSTEM, gaining full control of the target host.
[Mitigation] Apply the official Microsoft MS15-051 security patch immediately and restrict local execution privileges on unpatched systems.
Microsoft Windows win32k.sys TrueType Font Parsing Remote Code Execution Vulnerability (CVE-2014-4148, MS14-058)
[Affected Scope] Windows Server 2003/2008/2012, Windows Vista, Windows 7, Windows 8/8.1, and Windows RT systems.
[Impact] Remote attackers can execute arbitrary code with kernel-mode privileges and gain full system control by enticing users to render specially crafted TrueType fonts.
[Mitigation] Apply the official Microsoft security update (MS14-058) immediately, or implement workarounds to block untrusted font rendering.
Microsoft Windows Win32k.sys Kernel-Mode Driver Local Privilege Escalation Vulnerability (CVE-2014-4113) Analysis and Mitigation Guide
[Affected Scope] Windows Server 2003/2008/2012, Windows Vista, Windows 7, Windows 8, and 8.1 systems
[Impact] Local attackers can execute a specially crafted application to gain SYSTEM-level privileges and fully compromise the host
[Mitigation] Immediately apply the official Microsoft security patch (MS14-058) and restrict local execution privileges on unpatched systems
Microsoft Windows win32k.sys TrueType Font Parsing Engine Remote Code Execution Vulnerability (CVE-2011-3402, Duqu Exploited)
[Affected Scope] Windows XP, Vista, 7, and Windows Server 2003, 2008 kernel-mode drivers (win32k.sys)
[Impact] Remote code execution (RCE) with kernel-level privileges via crafted TrueType font data in Word documents or web pages
[Mitigation] Apply official MS11-087 security patches or implement the T2EMBED.DLL registry/ACL workaround
Microsoft Windows Ancillary Function Driver (afd.sys) Local Privilege Escalation Vulnerability (CVE-2011-2005, MS11-080)
[Affected Scope] Microsoft Windows XP SP2/SP3 and Windows Server 2003 SP2.
[Impact] Local attackers can execute arbitrary code in kernel mode and gain elevated SYSTEM privileges via a crafted application.
[Mitigation] Apply the official Microsoft MS11-080 security patch, or restrict local execution privileges and isolate legacy systems.