CVE-2016-0151

KEVRansomware UseMicrosoft Windows CSRSS Security Feature Bypass Vulnerability

Description

The Client-Server Run-time Subsystem (CSRSS) in Microsoft mismanages process tokens, which allows local users to gain privileges via a crafted application.

The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages process tokens, which allows local users to gain privileges via a crafted application, aka "Windows CSRSS Security Feature Bypass Vulnerability."

CVSS 3.1 vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

PublishedApr 12, 2016

Last modifiedJun 17, 2026

Added to KEVMar 28, 2022

Remediation dueApr 18, 2022

References

securitytracker.com/id/1035544Broken LinkThird Party Advisory
docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-048PatchVendor Advisory
exploit-db.com/exploits/39740/ExploitThird Party Advisory
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-0151US Government Resource

0 recent articles mention this CVE

Risk assessment · Critical

Actively exploited and used by ransomware crews. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1653 days
Ransomware: Used in known ransomware campaigns
CVSS: 7.8 HIGH
EPSS (30-day exploit probability): 62.8% · top 1% of all CVEs
Weakness: CWE-269

Recommended actions

1.Apply updates per vendor instructions.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
4.Verify offline/immutable backups and segment the affected systems. This flaw is used for ransomware initial access.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.