CVE-2010-4398

CVE-2010-4398 is a stack-based buffer overflow in the RtlQueryRegistryValues function of win32k.sys, the Microsoft Windows kernel driver, where mishandled registry-related input can overflow a stack buffer. A local attacker who can already run code on a Windows machine can trigger the flaw to execute code in the kernel, gaining elevated privileges and bypassing User Account Control (UAC). Per CISA, Microsoft Windows is affected; because exploitation requires an existing local foothold, this is a post-compromise privilege-escalation primitive rather than a remote attack vector. The vulnerability is confirmed exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-03-28, and EPSS assigns an 8.7% probability of exploitation within 30 days (95th percentile). No public proof-of-concept exploit is known.

What to do: Apply updates per vendor instructions as CISA requires: the fix shipped in Microsoft's February 2011 kernel security update (MS11-011), so any fully patched Windows system is remediated and the priority is auditing for legacy machines that missed it. Because the flaw only helps attackers who already have local code execution, restrict local privileges, maintain least-privilege accounts, and hunt legacy or poorly maintained hosts for signs of UAC bypass. Confirm patch status through Windows Update/WSUS history or patch-management inventory rather than relying on OS version heuristics.