CVE-2016-0165

CVE-2016-0165 is a Win32k elevation-of-privilege flaw in the Windows kernel-mode driver, affecting Windows Vista SP2 through Windows 10 version 1511 and the corresponding Server editions. An attacker must already be able to run a crafted application locally on the affected machine, at which point the flaw can be triggered to escape the user context. Successful exploitation grants the attacker SYSTEM/kernel-level privileges, providing complete confidentiality, integrity, and availability impact on the host. Any organization running the listed Windows versions is exposed, especially servers and workstations used for shared access. The flaw has been exploited in the wild: it was used as a zero-day in targeted attacks attributed to the FruityArmor APT, it carries a 13.8% EPSS probability of exploitation within 30 days, and CISA added it to the KEV on 2023-06-22, requiring federal agencies to apply vendor updates.

What to do: Apply the vendor security updates for CVE-2016-0165 per Microsoft's instructions on all affected Windows Vista, Server 2008/2012, Windows 7, 8.1, RT 8.1, and Windows 10 1507/1511 systems, prioritizing KEV-driven remediation. Because this is a local privilege escalation, limit interactive and remote logon rights to untrusted users on hosts that cannot be patched immediately, and ensure endpoint monitoring watches for the FruityArmor-style targeted attack activity. Systems such as Vista, Windows 7, and Windows 10 1507/1511 that are past mainstream support should be upgraded to a supported OS release where possible.