CVE-2015-2527

Name of the Vulnerable Software and Affected Versions Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT Gold and 8.1 Windows 10

Description The issue is related to the process-initialization implementation in win32k.sys, which does not properly constrain impersonation levels. This allows local users to gain privileges via a crafted application. An attacker who successfully exploits the issue could run arbitrary code in kernel mode, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights. To exploit the issue, an attacker would first have to log on to the system.

Recommendations For Windows 8, update to a version that includes the fix for this issue. For Windows 8.1, update to a version that includes the fix for this issue. For Windows Server 2012 Gold and R2, update to a version that includes the fix for this issue. For Windows RT Gold and 8.1, update to a version that includes the fix for this issue. For Windows 10, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the win32k.sys component to minimize the risk of exploitation.