How to Fix CVE-2016-0167: Microsoft Win32k Privilege Escalation Vulnerability

By the Sai Kiran Pandrala · Reviewed and edited by Sai Kiran Pandrala, Editor

⚠️ Patch immediately. CVE-2016-0167 is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03). Federal agencies had until 2022-05-03 to remediate.

What is CVE-2016-0167?

CVE-2016-0167 is a local elevation-of-privilege flaw in win32k.sys, the Windows kernel-mode driver that handles the graphics and windowing subsystem (GDI, window manager, USER objects). A local, low-privileged user runs a crafted application that abuses how the driver validates or tracks kernel objects, and that application ends up executing code in kernel context. The result is a jump from a normal user account to full SYSTEM rights on the box.

Microsoft labelled it the "Win32k Elevation of Privilege Vulnerability." It is a distinct bug from the sibling Win32k issues fixed in the same patch round, CVE-2016-0143 and CVE-2016-0165: all three landed in the April 2016 cumulative kernel-mode driver update but are tracked separately. The affected surface spans Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511.

This is elevation of privilege, not remote code execution. The CVSS 3.1 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8, High): the attacker needs local access and some user interaction to launch the malicious app, but no prior privileges. Win32k bugs like this one are the classic second stage of a real-world intrusion, a phishing payload or browser exploit lands as a normal user, then this flaw is chained in to seize SYSTEM and disable defenses. The CVE record assigns no specific CWE ("not enough information"), but functionally it sits in the privilege-management / improper-object-handling family.

Am I affected?

You are exposed if the host is running any of the listed Windows versions and has not received the April 2016 (or any later) security rollup. Because the fix shipped in MS16-039, the cleanest check is whether the corresponding KB for your OS is installed. Run this in an elevated PowerShell prompt:

# Show OS version and the most recent installed hotfixes
[System.Environment]::OSVersion.Version
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 20 HotFixID, InstalledOn

# MS16-039 KBs by OS (check for yours or any newer cumulative update):
#   Windows 10 1511 ........ KB3147458
#   Windows 10 Gold ........ KB3147461
#   Windows 8.1 / 2012 R2 .. KB3147460  (security-only) / KB3147461 (rollup)
#   Windows 7 SP1 / 2008 R2  KB3147071  (security-only) / KB3148522 (rollup)
#   Server 2012 ............ KB3147460
#   Vista SP2 / 2008 SP2 ... KB3147461 family
Get-HotFix -Id KB3147071, KB3147458, KB3147460, KB3147461 -ErrorAction SilentlyContinue

If none of the MS16-039 KBs (or a newer cumulative/monthly rollup that supersedes them) appear, the machine is vulnerable. Modern Windows 7/8.1/Server builds receive these through later monthly rollups, so a fully patched system is already covered. this CVE only matters on hosts frozen at a pre-April-2016 patch level.

How to fix CVE-2016-0167

The fix is Microsoft security update MS16-039. There is no third-party package, no apt/dnf package, and no separate installer to download for the driver itself, the patch ships as a standard Windows Update for the OS. Apply the cumulative/monthly rollup for your Windows version (any rollup from April 2016 onward includes this fix).

Option 1: Windows Update (simplest)

On a single machine, open Settings or Control Panel and install all pending updates, then reboot. On Windows 7/Server 2008 R2 use Control Panel → Windows Update; on Windows 8.1/10 use Settings → Update & Security. Reboot is required because the patched win32k.sys is in use and is only swapped in at boot.

Option 2, Drive the update from PowerShell

# Run as Administrator. Uses the PSWindowsUpdate module (Install-Module PSWindowsUpdate).
Import-Module PSWindowsUpdate

# See what is pending
Get-WindowsUpdate

# Install all security updates and reboot automatically when done
Install-WindowsUpdate -AcceptAll -Install -AutoReboot

Option 3. Install the specific KB offline (.msu)

For air-gapped or WSUS-managed fleets, download the matching update for your OS from the Microsoft Update Catalog (catalog.update.microsoft.com, search "MS16-039" or the KB number from the table above) and apply the .msu with the Windows Update Standalone Installer:

# Run as Administrator. Substitute the .msu that matches the host's OS/architecture.
wusa.exe C:\Patches\windows8.1-kb3147460-x64.msu /quiet /norestart

# Then reboot to load the patched win32k.sys
Restart-Computer -Force

Verify the fix

# After reboot, confirm the MS16-039 KB (or a superseding rollup) is present
Get-HotFix -Id KB3147071, KB3147458, KB3147460, KB3147461 -ErrorAction SilentlyContinue

# Optional: confirm the patched win32k.sys file version (April 2016 build or newer)
(Get-Item "$env:SystemRoot\System32\win32k.sys").VersionInfo.FileVersion

If Get-HotFix returns the KB and the machine has rebooted, the vulnerable driver has been replaced. If your environment has moved on to later monthly rollups, those supersede MS16-039 and the older KB IDs may not appear individually, that is expected and still patched.

If you can't patch immediately

There is no official Microsoft workaround for CVE-2016-0167: the security bulletin lists none, and patching is the only documented fix. Win32k runs inside every interactive Windows session, so you cannot simply firewall it off or disable the component. If you genuinely cannot deploy MS16-039 on an affected host yet, reduce the blast radius with these measures:

• Cut off the local foothold. This bug needs a local, interactive attacker running code. Remove standing local-admin rights, restrict who can log on interactively, and block users from running arbitrary executables (AppLocker / Software Restriction Policies) so the crafted application has nowhere to launch from.
• Harden against the first stage. EoP is the second step of a chain. Keep email filtering, macro blocking, and browser/Office patches current so the initial payload that would trigger this exploit never lands.
• Isolate the host. If it is a legacy machine you cannot patch, segment it onto a restricted VLAN, limit lateral RDP/SMB reach, and monitor it closely for unexpected SYSTEM-level process creation.

Treat all of the above as stopgaps. The only real remediation is installing the update and rebooting.

Frequently asked questions

Is CVE-2016-0167 being actively exploited?

Yes. It was exploited as a zero-day before the patch, and CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03. In-the-wild exploitation is confirmed, which is why the fix should be treated as an emergency change.

Is this remote code execution?

No. CVE-2016-0167 is a local elevation-of-privilege flaw in the Win32k kernel-mode driver. An attacker must already be able to run code on the machine as a normal user; this bug then lets them escalate to SYSTEM. It is typically chained behind a separate initial-access exploit.

Which update fixes it, and do I need to reboot?

Microsoft security update MS16-039 (April 2016 Patch Tuesday) fixes it, delivered as the standard kernel-mode driver KB for your Windows version (for example KB3147071 on Windows 7 SP1, KB3147460 on Windows 8.1/Server 2012 R2). Any monthly rollup from April 2016 onward also includes it. A reboot is required because win32k.sys is loaded and only replaced at boot.

My scanner still flags CVE-2016-0167 after patching, why?

Confirm the host actually rebooted, then re-run the scan. Many scanners key off the presence of a specific KB; if a later cumulative rollup superseded MS16-039, the original KB ID may not show up and a banner-only scanner can misreport it. Verify with Get-HotFix and the win32k.sys file version instead.

References

• Official vendor advisory: http://www.securitytracker.com/id/1035529
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2016-0167
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Additional reference: http://www.securitytracker.com/id/1035532
• Additional reference: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-039

Written by Sai Kiran Pandrala on 2026-05-25. Sourced from the official vendor advisory, the NVD record, and the CISA KEV listing. Always confirm against the vendor advisory before applying changes in production.

Related fixes

Other defects in the same area that deserve attention during this patch cycle:

• How to Fix CVE-2016-2386: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti
• How to Fix CVE-2016-3715: Arbitrary file deletion in ImageMagick
• How to Fix CVE-2016-11021: OS Command Injection in D-Link DCS-930L Devices
• How to Fix CVE-2016-4523: Out-of-Bounds Read in Trihedral VTScada (formerly VTS)
• How to Fix CVE-2016-3643: Privilege escalation in SolarWinds Virtualization Manager