CVE-2013-3660

CVE-2013-3660 is a local privilege-escalation flaw in the EPATHOBJ::pprFlattenRec function of win32k.sys, Microsoft's Windows kernel-mode driver: the function does not properly initialize the pointer to the next object in a list, producing kernel memory corruption (CWE-119). It is triggered by code running locally on the machine that exercises the Win32k/GDI path-flattening routine so the kernel follows an uninitialized pointer; no network access is required. An attacker who already has a foothold on the system (for example a low-privileged user, or an attacker chaining this flaw into another exploit) can elevate to kernel privileges, typically gaining full SYSTEM-level control of the host. Any Microsoft Windows system running the affected win32k.sys kernel-mode drivers is exposed, i.e., essentially unpatched Windows desktops, laptops, and servers; CISA lists the affected product simply as 'Microsoft Win32k'. The flaw is confirmed exploited in the wild - it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-28 (ransomware use unknown) - and EPSS assigns a 39.6% probability of exploitation within 30 days (99th percentile), while no public PoC is recorded in the source data.

What to do: Apply vendor updates per CISA's KEV required action - this flaw was fixed in Microsoft's July 2013 Windows kernel security update (MS13-048), so verify via patch inventory that all endpoints and servers, especially long-lived legacy Windows systems, have that update or later. Because exploitation requires only local code execution, prioritize user-facing workstations, VDI and jump hosts, and confirm patch status through patch management rather than assuming based on OS version.