{"id":"CVE-2016-0151","kind":"vulnerability","aliases":["CVE-2016-0151"],"related":[],"title":"Microsoft Client-Server Run-time Subsystem (CSRSS): Microsoft Windows CSRSS Security Feature Bypass Vulnerability","description":"The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages process tokens, which allows local users to gain privileges via a crafted application, aka \"Windows CSRSS Security Feature Bypass Vulnerability.\"","summary":"Microsoft Windows CSRSS mismanages process tokens, letting a local user gain elevated privileges by running a crafted application. Exploitation is confirmed in the wild and CISA's KEV lists it with ransomware use.","severity":"high","cvss":7.8,"epss":0.62943,"exploited":true,"exploited_at":"2022-03-28T00:00:00+00:00","products":[{"name":"Microsoft Client-Server Run-time Subsystem (CSRSS)","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","microsoft-windows","ransomware","windows"],"not_affected_if":["fully-patched-windows"],"how_to_check":null,"fix":"Apply the Microsoft Windows updates per vendor instructions (CISA KEV required action); the specific KB or patched build is not stated in the sources.","status":"open","published_at":"2016-04-12T23:59:15+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:19:42+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T21:19:42Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft Windows updates per vendor instructions (CISA KEV required action); the specific KB or patched build is not stated in the sources.","reach":"local","impact":"high","summary":"Microsoft Windows CSRSS mismanages process tokens, letting a local user gain elevated privileges by running a crafted application. Exploitation is confirmed in the wild and CISA's KEV lists it with ransomware use.","category":"infrastructure","who_cares":["windows","microsoft-windows"],"confidence":0.7,"needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the Windows machine","analyst_note":"Find the affected Windows builds and the specific Microsoft security bulletin (MS16-014 or similar) at msrc.microsoft.com for the how_to_check and fix fields.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["fully-patched-windows"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00047,"input_tokens":2879,"output_tokens":365,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-0151':19A,22A '-2016':18A,21A '10':96C '1511':99C '2012':87C '8.1':84C,93C 'aka':114C 'allow':104C 'applic':56B,113C 'bypass':15A,119C 'cisa':64B 'client':3A,25A,74C 'client-serv':2A,73C 'client-server':24A 'confirm':59B 'craft':55B,112C 'csrss':9A,12A,31A,41B,80C,116C 'cve':17A,20A 'elev':50B 'exploit':32B,57B 'featur':14A,118C 'gain':49B,108C 'gold':88C,97C 'infrastructur':33B 'kev':66B 'let':45B 'list':67B 'local':47B,105C 'microsoft':1A,10A,23A,35B,39B,82C 'microsoft-window':34B 'mismanag':42B,100C 'privileg':51B,109C 'process':43B,101C 'r2':90C 'ransomwar':37B,70B 'rt':92C 'run':6A,28A,53B,77C 'run-tim':5A,76C 'run-time':27A 'secur':13A,117C 'server':4A,26A,75C,86C 'subsystem':8A,30A,79C 'time':7A,29A,78C 'token':44B,102C 'use':71B 'user':48B,106C 'via':110C 'vulner':16A,120C 'wild':62B 'window':11A,36B,38B,40B,83C,85C,91C,95C,115C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2016-04-12T23:59:15+00:00","kev":{"dateAdded":"2022-03-28","dueDate":"2022-04-18","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2016-0151","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-0151","severity":null,"published_at":"2022-03-28T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T13:39:31+00:00","note":null},{"source":"epss","external_id":"CVE-2016-0151","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-0151","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2016-0151","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0151","severity":null,"published_at":"2016-04-12T23:59:15+00:00","modified_at":"2026-06-17T00:37:00+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}