CVE-2015-2360

CVE-2015-2360 is a memory-handling flaw (CWE-119) in Win32k.sys, the Windows kernel-mode driver, that allows a local user to elevate privileges or cause a denial-of-service crash. It is triggered by local code that drives Win32k into improperly handling objects in memory, letting the attacker run code with kernel/SYSTEM-level rights — typically chained with a separate remote code execution bug to go from network access to full system compromise. Any Microsoft Windows system that has not received the vendor fix is affected, and because the fix shipped in mid-2015, the remaining exposed population is largely legacy Windows deployments that missed regular patching. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2022-05-25, indicating exploitation in the wild, and EPSS assigns a 15% probability of exploitation within 30 days (96th percentile); no public proof-of-concept is known.

What to do: Apply the Microsoft update from security Bulletin MS15-078 (July 2015) to any Windows system lacking it, prioritizing internet-facing hosts running legacy Windows/Server releases and POS, embedded or air-gapped systems that miss routine patch cycles. Verify via patch inventory that the affected Win32k.sys builds are current, and treat the CISA KEV listing as mandatory remediation per the required action (apply updates per vendor instructions).