{"id":"CVE-2015-2360","kind":"vulnerability","aliases":["CVE-2015-2360"],"related":[],"title":"win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows…","description":"win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted application, aka \"Win32k Elevation of Privilege Vulnerability.\"","summary":"Win32k.sys, the Windows kernel-mode graphics driver, has a flaw that lets a local user gain higher privileges or crash the system. CISA lists it as actively exploited in the wild.","severity":"high","cvss":8.8,"epss":0.1484,"exploited":true,"exploited_at":"2022-05-25T00:00:00+00:00","products":[{"name":"Microsoft Win32k","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows 7","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows 8","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows 8.1","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows rt","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows rt 8.1","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows server 2003","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows server 2003","fixed":[],"affected":"= r2","ecosystem":"vendor"},{"name":"microsoft windows server 2008","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows server 2008","fixed":[],"affected":"= r2","ecosystem":"vendor"},{"name":"microsoft windows server 2012","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows server 2012","fixed":[],"affected":"= r2","ecosystem":"vendor"},{"name":"microsoft windows vista","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","microsoft-windows","windows"],"not_affected_if":["patched-windows"],"how_to_check":null,"fix":"Apply the Microsoft updates for this CVE per vendor instructions; the sources do not name the specific KB or Windows build.","status":"open","published_at":"2015-06-10T01:59:38+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:15:33+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:15:33Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft updates for this CVE per vendor instructions; the sources do not name the specific KB or Windows build.","reach":"local","impact":"high","summary":"Win32k.sys, the Windows kernel-mode graphics driver, has a flaw that lets a local user gain higher privileges or crash the system. CISA lists it as actively exploited in the wild.","category":"infrastructure","who_cares":["windows","microsoft-windows"],"confidence":0.6,"needs_auth":"yes","worst_case":"local user gains system privileges or crashes the machine","analyst_note":"Find the Microsoft security bulletin for CVE-2015-2360 (MS15-051) and list the affected Windows builds and KB numbers for how_to_check and fix.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["patched-windows"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000451,"input_tokens":2832,"output_tokens":335,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2015':22A,25A '-2360':23A,26A '2003':12A,48A,52A,121C '2008':56A,60A,131C '2012':64A,68A,145C '7':31A,137C '8':34A,140C '8.1':37A,44A,142C,154C 'activ':105B 'aka':173C 'allow':155C 'applic':172C 'caus':162C 'cisa':101B 'corrupt':168C 'craft':171C 'crash':98B 'cve':21A,24A 'denial':164C 'driver':7A,85B,116C 'elev':175C 'exploit':72B,106B 'flaw':88B 'gain':94B,159C 'gold':146C,152C 'graphic':84B 'higher':95B 'infrastructur':73B 'kernel':5A,82B,114C 'kernel-mod':4A,81B,113C 'let':90B 'list':102B 'local':92B,156C 'memori':167C 'microsoft':9A,27A,29A,32A,35A,38A,41A,45A,49A,53A,57A,61A,65A,69A,75B,118C 'microsoft-window':74B 'mode':6A,83B,115C 'privileg':96B,160C,177C 'r2':15A,124C,134C,148C 'rt':40A,43A,151C 'server':11A,47A,51A,55A,59A,63A,67A,120C,130C,144C 'servic':166C 'sp1':135C,138C 'sp2':13A,16A,19A,122C,125C,128C,132C 'system':100B 'user':93B,157C 'via':169C 'vista':18A,71A,127C 'vulner':178C 'wild':109B 'win32k':28A,174C 'win32k.sys':1A,78B,110C 'window':10A,17A,20A,76B,77B,80B,119C,126C,129C,136C,139C,141C,143C,150C 'windows':30A,33A,36A,39A,42A,46A,50A,54A,58A,62A,66A,70A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2015-06-10T01:59:38+00:00","kev":{"dateAdded":"2022-05-25","dueDate":"2022-06-15","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2015-2360","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-2360","severity":null,"published_at":"2022-05-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T11:39:16+00:00","note":null},{"source":"epss","external_id":"CVE-2015-2360","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-2360","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2015-2360","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-2360","severity":null,"published_at":"2015-06-10T01:59:38+00:00","modified_at":"2026-06-17T00:23:58+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}