What is the CVSS score of CVE-2016-0167?

CVE-2016-0167 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 6.1%.

Which versions of Microsoft are affected by CVE-2016-0167?

CVE-2016-0167 presents notable security risk rated CVSS 7.8. Exploitation could compromise the security of affected deployments.. A patch is available.

Is CVE-2016-0167 being actively exploited?

Yes, CVE-2016-0167 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming active in-the-wild exploitation. Immediate patching is required.

How to fix or mitigate CVE-2016-0167?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Vendor patch is available.

Microsoft CVE-2016-0167

HIGH

2016-04-12 secure@microsoft.com

Information Disclosure Microsoft

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 21, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Mar 26, 2026 - 11:18 vuln.today

Added to CISA KEV

Oct 22, 2025 - 00:15 cisa

CISA KEV

Patch released

Oct 22, 2025 - 00:15 nvd

Patch available

CVE Published

Apr 12, 2016 - 23:59 nvd

HIGH 7.8

DescriptionCVE.org

The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0143 and CVE-2016-0165.

AnalysisAI

The Win32k kernel-mode driver in Windows Vista through Windows 10 allows local privilege escalation through an unspecified vulnerability in window object handling, exploited in the wild by APT groups.

Technical ContextAI

The win32k.sys vulnerability involves improper handling of window objects in the kernel-mode graphics subsystem. A crafted application can trigger a condition that allows writing to kernel memory, enabling token replacement for privilege escalation.

RemediationAI

Apply Microsoft security update MS16-039. Deploy Windows Defender Exploit Guard with ASR rules to limit win32k attack surface from sandboxed processes.