Back to KEVs

CVE-2015-1701

Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows local users to gain privileges...

Basic Information

CVE State: PUBLISHED
Reserved Date: February 17, 2015
Published Date: April 21, 2015
Last Updated: February 10, 2025
Vendor: n/a
Product: n/a
Description: Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in April 2015, aka "Win32k Elevation of Privilege Vulnerability."

CVSS Scores

CVSS v3.1

7.8 - HIGH

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC Information

Exploitation: active
Technical Impact: total

Exploit Status

Exploited in the Wild: Yes (added 2022-03-03 00:00:00 UTC) Source
Proof of Concept Available: Yes (added 2022-03-21 06:39:18 UTC) Source
Used in Malware: Yes (added 2022-03-03 00:00:00 UTC) Source

References

http://twitter.com/symantec/statuses/590208710527549440 https://www.exploit-db.com/exploits/37049/ http://www.securityfocus.com/bid/74245 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-051 https://www.exploit-db.com/exploits/37367/ https://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html http://www.securitytracker.com/id/1032155 http://seclists.org/fulldisclosure/2020/May/34

Known Exploited Vulnerability Information

Source	Added Date
CISA	2022-03-03 00:00:00 UTC

Scanner Integrations

Scanner	URL	Date Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/ms15_051_client_copy_image.rb	2025-04-29 11:01:41 UTC

Potential Proof of Concepts

Warning: These PoCs have not been tested and could contain malware. Use at your own risk.

ms15_051_client_copy_image

Type: metasploit • Created: Unknown

Metasploit module for CVE-2015-1701

Anonymous-Family/CVE-2015-1701-download

Type: github • Created: 2022-03-21 06:39:18 UTC • Stars: 0

Anonymous-Family/CVE-2015-1701

Type: github • Created: 2022-03-21 06:26:21 UTC • Stars: 0

Unspecified vulnerability in Microsoft Windows before 8 allows local users to gain privileges via unknown vectors, as exploited in the wild in April 2015 (Base Score: 7.2 HIGH) Current Description Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in April 2015, aka "Win32k Elevation of Privilege Vulnerability

hfiref0x/CVE-2015-1701

Type: github • Created: 2015-05-12 18:04:48 UTC • Stars: 287

Win32k LPE vulnerability used in APT attack