{"id":"CVE-2016-0151","published":"2016-04-12T23:59:15Z","modified":"2026-06-17T00:37:00Z","title":"Microsoft Windows CSRSS Security Feature Bypass Vulnerability","vendor":"Microsoft","product":"Client-Server Run-time Subsystem (CSRSS)","tier":"core","eol":null,"description":{"text":"The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages process tokens, which allows local users to gain privileges via a crafted application, aka \"Windows CSRSS Security Feature Bypass Vulnerability.\"","provenance":"source","from":"NVD"},"summary":{"text":"The Client-Server Run-time Subsystem (CSRSS) component of Microsoft Windows mismanages process tokens, creating a security feature bypass flaw. A local user who runs a crafted application can gain elevated privileges, and exploitation requires local access, no prior authentication, and user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:59:06Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.62823,"percentile":0.99193,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-03-28","dueDate":"2022-04-18","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-0151","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-03-28","exploitedFirstSeen":"2022-03-28","ransomware":true,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-28"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-269","name":"Improper Privilege Management"},{"id":"CWE-264","name":null}],"references":[{"url":"http://www.securitytracker.com/id/1035544","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-048","tags":["Patch","Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/39740/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1035544","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-048","tags":["Patch","Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/39740/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-0151","tags":["US Government Resource"]}],"techniques":[{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: user runs crafted application locally","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows local users to gain privileges via a crafted application","start":182,"end":245}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: token mismanagement yields local privilege escalation","mappingType":"primary_impact","evidence":[{"from":"description","quote":"mismanages process tokens, which allows local users to gain privileges","start":149,"end":219}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2016-0189","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2016-0189","exploited":true,"exploitedSince":"2022-03-28","provenance":"source"},"exploits":[{"id":39740,"url":"https://www.exploit-db.com/exploits/39740","title":"Microsoft Windows - CSRSS BaseSrvCheckVDM Session 0 Process Creation Privilege Escalation (MS16-048)","type":"dos","platform":"windows","date":"2016-04-27","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2016-04-27"},"first":{"date":"2016-04-27","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/39740"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/39740/"],"flow":[{"stage":"exploitation","techniques":["T1204.002"],"provenance":"ai"},{"stage":"primary","techniques":["T1068"],"provenance":"ai"}],"timeline":[{"date":"2016-04-12","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0151","provenance":"source"},{"date":"2016-04-27","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-39740)","url":"https://www.exploit-db.com/exploits/39740","provenance":"source"},{"date":"2022-03-28","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2022-03-28","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-28","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2016-0189","provenance":"source"}],"speed":{"daysToPublicExploit":15,"firstExploitFrom":"Exploit-DB","daysToKev":2176},"priority":{"score":78.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1676 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.84,"detail":"percentile 0.9919"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Exploit-DB entry"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}