CVE-2010-4398

KEVMicrosoft Windows Kernel Stack-Based Buffer Overflow Vulnerability

Description

Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows allows local users to gain privileges, and bypass the User Account Control (UAC) feature.

Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows local users to gain privileges, and bypass the User Account Control (UAC) feature, via a crafted REG_BINARY value for a SystemDefaultEUDCFont registry key, aka "Driver Improper Interaction with Windows Kernel Vulnerability."

CVSS 3.1 vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

PublishedDec 6, 2010

Last modifiedJun 16, 2026

Added to KEVMar 28, 2022

Remediation dueApr 21, 2022

References

isc.sans.edu/diary.html?storyid=9988ExploitIssue Tracking
nakedsecurity.sophos.com/2010/11/25/new-windows-zero-day-flaw-bypasses-uac/Broken Link
secunia.com/advisories/42356Broken LinkVendor Advisory
support.avaya.com/css/P8/documents/100127248Third Party Advisory
twitter.com/msftsecresponse/statuses/7590788200402945Not Applicable
exploit-db.com/bypassing-uac-with-user-privilege-under-windows-vista7-mirror/Broken LinkExploit
exploit-db.com/exploits/15609/ExploitThird Party Advisory
kb.cert.org/vuls/id/529673Third Party AdvisoryUS Government Resource
securityfocus.com/bid/45045Broken LinkThird Party Advisory
securitytracker.com/id?1025046Broken LinkThird Party Advisory
vupen.com/english/advisories/2011/0324Broken Link
docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-011PatchVendor Advisory

0 recent articles mention this CVE

Risk assessment · High

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1650 days
CVSS: 7.8 HIGH
EPSS (30-day exploit probability): 8.7% · top 5% of all CVEs
Weakness: CWE-787

Recommended actions

1.Apply updates per vendor instructions.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.