{"id":"CVE-2013-3660","published":"2013-05-24T20:55:01Z","modified":"2026-06-16T23:55:35Z","title":"Microsoft Win32k Privilege Escalation Vulnerability","vendor":"Microsoft","product":"Win32k","tier":"core","eol":null,"description":{"text":"The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, and Windows Server 2012 does not properly initialize a pointer for the next object in a certain list, which allows local users to obtain write access to the PATHRECORD chain, and consequently gain privileges, by triggering excessive consumption of paged memory and then making many FlattenPath function calls, aka \"Win32k Read AV Vulnerability.\"","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is in the EPATHOBJ::pprFlattenRec function in win32k.sys, the kernel-mode driver in Microsoft Windows Win32k, where a pointer for the next object in a certain list is not properly initialized. A local user who can trigger excessive consumption of paged memory and then make many FlattenPath calls can gain write access to the PATHRECORD chain and thereby escalate privileges, requiring only local access with no authentication but some user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:11:17Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.39318,"percentile":0.98601,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-03-28","dueDate":"2022-04-18","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2013-3660","provenance":"source"},"vulncheckKev":{"dateAdded":"2015-01-06","exploitedFirstSeen":"2015-01-06","ransomware":true,"evidence":[{"url":"https://blog.talosintelligence.com/2015/01/ransomware-on-steroids-cryptowall-20.html","date":"2015-01-06"},{"url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf","date":"2015-02-01"},{"url":"https://www.welivesecurity.com/2015/04/09/operation-buhtrap/","date":"2015-04-09"},{"url":"https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf","date":"2016-04-01"},{"url":"https://dl.acm.org/doi/pdf/10.1145/3465481.3465758","date":"2021-08-17"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-28"}],"evidenceTotal":6,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer"}],"references":[{"url":"http://archives.neohapsis.com/archives/fulldisclosure/2013-05/0090.html","tags":["Broken Link"]},{"url":"http://archives.neohapsis.com/archives/fulldisclosure/2013-05/0094.html","tags":["Broken Link"]},{"url":"http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0006.html","tags":["Broken Link"]},{"url":"http://secunia.com/advisories/53435","tags":["Broken Link","Vendor Advisory"]},{"url":"http://twitter.com/taviso/statuses/309157606247768064","tags":["Exploit"]},{"url":"http://twitter.com/taviso/statuses/335557286657400832","tags":["Not Applicable"]},{"url":"http://www.computerworld.com/s/article/9239477","tags":["Broken Link"]},{"url":"http://www.exploit-db.com/exploits/25611/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.osvdb.org/93539","tags":["Broken Link"]},{"url":"http://www.reddit.com/r/netsec/comments/1eqh66/0day_windows_kernel_epathobj_vulnerability/","tags":["Exploit","Issue Tracking"]},{"url":"http://www.theverge.com/2013/5/23/4358400/google-engineer-bashes-microsoft-discloses-windows-flaw","tags":["Press/Media Coverage"]},{"url":"http://www.us-cert.gov/ncas/alerts/TA13-190A","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-053","tags":["Patch","Vendor Advisory"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17360","tags":["Broken Link"]},{"url":"http://archives.neohapsis.com/archives/fulldisclosure/2013-05/0090.html","tags":["Broken Link"]},{"url":"http://archives.neohapsis.com/archives/fulldisclosure/2013-05/0094.html","tags":["Broken Link"]},{"url":"http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0006.html","tags":["Broken Link"]},{"url":"http://secunia.com/advisories/53435","tags":["Broken Link","Vendor Advisory"]},{"url":"http://twitter.com/taviso/statuses/309157606247768064","tags":["Exploit"]},{"url":"http://twitter.com/taviso/statuses/335557286657400832","tags":["Not Applicable"]},{"url":"http://www.computerworld.com/s/article/9239477","tags":["Broken Link"]},{"url":"http://www.exploit-db.com/exploits/25611/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.osvdb.org/93539","tags":["Broken Link"]},{"url":"http://www.reddit.com/r/netsec/comments/1eqh66/0day_windows_kernel_epathobj_vulnerability/","tags":["Exploit","Issue Tracking"]},{"url":"http://www.theverge.com/2013/5/23/4358400/google-engineer-bashes-microsoft-discloses-windows-flaw","tags":["Press/Media Coverage"]},{"url":"http://www.us-cert.gov/ncas/alerts/TA13-190A","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-053","tags":["Patch","Vendor Advisory"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17360","tags":["Broken Link"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-3660","tags":["US Government Resource"]}],"techniques":[{"id":"T1608","name":"Stage Capabilities","tactics":["resource-development"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: local kernel exploit grants privilege escalation","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"does not properly initialize a pointer for the next object in a certain list, which allows local users to obtain write access","start":245,"end":370}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: yields elevated privileges on the system","mappingType":"primary_impact","evidence":[{"from":"description","quote":"consequently gain privileges, by triggering excessive consumption of paged memory","start":400,"end":481}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2013-3593","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2013-3593","exploited":true,"exploitedSince":"2022-03-28","provenance":"source"},"exploits":[{"id":25611,"url":"https://www.exploit-db.com/exploits/25611","title":"Microsoft Windows - Win32k!EPATHOBJ::pprFlattenRec Uninitialized Next Pointer Testcase","type":"dos","platform":"windows","date":"2013-05-21","verified":true,"provenance":"source"},{"id":25912,"url":"https://www.exploit-db.com/exploits/25912","title":"Microsoft Windows NT/2000/2003/2008/XP/Vista/7/8 - 'EPATHOBJ' Local Ring","type":"local","platform":"windows","date":"2013-06-03","verified":true,"provenance":"source"},{"id":26554,"url":"https://www.exploit-db.com/exploits/26554","title":"Microsoft Windows - 'EPATHOBJ::pprFlattenRec' Local Privilege Escalation (Metasploit)","type":"local","platform":"windows","date":"2013-07-02","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":3,"earliest":"2013-05-21"},"pocGithub":{"count":1,"skipped":1,"earliest":"2022-01-29","earliestUrl":"https://github.com/ExploitCN/CVE-2013-3660-x64-WIN7","repos":[{"name":"ExploitCN/CVE-2013-3660-x64-WIN7","url":"https://github.com/ExploitCN/CVE-2013-3660-x64-WIN7","stars":2,"created":"2022-01-29"}]},"metasploit":[{"name":"Windows EPATHOBJ::pprFlattenRec Local Privilege Escalation","module":"exploit/windows/local/ppr_flatten_rec","type":"exploit","disclosureDate":"2013-05-15","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/ppr_flatten_rec.rb"}],"first":{"date":"2013-05-15","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/ppr_flatten_rec.rb"},"provenance":"source"},"exploitRefs":["http://twitter.com/taviso/statuses/309157606247768064","http://www.exploit-db.com/exploits/25611/","http://www.reddit.com/r/netsec/comments/1eqh66/0day_windows_kernel_epathobj_vulnerability/"],"flow":[{"stage":"exploitation","techniques":["T1068"],"provenance":"ai"},{"stage":"primary","techniques":["T1078"],"provenance":"ai"},{"stage":"related","techniques":["T1608"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2013-05-15","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2013-05-21, PoC-in-GitHub 2022-01-29","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/ppr_flatten_rec.rb","provenance":"source"},{"date":"2013-05-24","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2013-3660","provenance":"source"},{"date":"2015-01-06","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://blog.talosintelligence.com/2015/01/ransomware-on-steroids-cryptowall-20.html","provenance":"source"},{"date":"2022-03-28","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-28","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2013-3593","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":3230},"priority":{"score":78.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 4314 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.72,"detail":"percentile 0.9860"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 NVD references tagged Exploit; 3 Exploit-DB entries; 1 PoC-in-GitHub repo; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-windows-cwe-119"}}