---
id: "CVE-2016-0151"
kind: "vulnerability"
aliases: ["CVE-2016-0151"]
title: "Microsoft Client-Server Run-time Subsystem (CSRSS): Microsoft Windows CSRSS Security Feature Bypass Vulnerability"
severity: "high"
cvss: 7.8
epss: 0.62943
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Microsoft Client-Server Run-time Subsystem (CSRSS)", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "microsoft-windows", "ransomware", "windows"]
not_affected_if: ["fully-patched-windows"]
published_at: "2016-04-12T23:59:15+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-0151", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2016-0151", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0151", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Microsoft Client-Server Run-time Subsystem (CSRSS): Microsoft Windows CSRSS Security Feature Bypass Vulnerability

Microsoft Windows CSRSS mismanages process tokens, letting a local user gain elevated privileges by running a crafted application. Exploitation is confirmed in the wild and CISA's KEV lists it with ransomware use.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Client-Server Run-time Subsystem (CSRSS) affected ? fixed ?

## Fix

Apply the Microsoft Windows updates per vendor instructions (CISA KEV required action); the specific KB or patched build is not stated in the sources.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-0151
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2016-0151
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2016-0151

## From the sources

The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages process tokens, which allows local users to gain privileges via a crafted application, aka "Windows CSRSS Security Feature Bypass Vulnerability."

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_