How to Fix CVE-2016-7255: Microsoft Win32k Privilege Escalation Vulnerability

By the Sai Kiran Pandrala · Reviewed and edited by Sai Kiran Pandrala, Editor

⚠️ Patch immediately. CVE-2016-7255 is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03). Federal agencies had until 2022-05-03 to remediate.

What is CVE-2016-7255?

CVE-2016-7255 is a local elevation of privilege flaw in Win32k, the kernel-mode driver (win32k.sys) that handles windowing and the graphics device interface for Windows. Microsoft tracked it as the “Win32k Elevation of Privilege Vulnerability” and fixed it in security bulletin MS16-135.

The root cause sits in how Win32k validates a window-object property write. The published proof-of-concept abuses NtSetWindowLongPtr to corrupt a single controlled bit in kernel memory: Trend Micro's write-up nicknamed it the “one-bit” bug. That one bit is enough to flip an access check on a window object and walk it into an arbitrary kernel write, which an attacker turns into a token-stealing primitive. The result: code running as a normal user is elevated to NT AUTHORITY\SYSTEM.

Two things matter for how you treat this:

• It is not remote. CVE-2016-7255 cannot be fired across the network on its own. The attacker first needs code execution on the box as any local user, through a malicious document macro, a drive-by, a phishing payload, or an already-compromised low-privilege service. Win32k is the second stage that turns that foothold into full control.
• It was used by a real adversary before the patch. Google's Threat Analysis Group and Microsoft both attributed in-the-wild use of this bug to the STRONTIUM group (also tracked as APT28 / Fancy Bear), chained behind an Adobe Flash zero-day (CVE-2016-7855). Flash got the attacker in; CVE-2016-7255 got them SYSTEM. That chain is why Google disclosed early and why CISA later put this CVE in the KEV catalog.

CVSS 3.1 scores it 7.8 (High) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. local attack vector, low complexity, no prior privileges, user interaction required (the victim runs the crafted application), with total impact to confidentiality, integrity, and availability once kernel access is gained.

Am I affected?

You are affected if the host runs any of the listed Windows versions and has not received a cumulative update or rollup dated November 2016 or later. The bug is in win32k.sys itself, which ships with every desktop and server SKU in the affected list, there is nothing optional to enable, so an unpatched install is vulnerable by default.

Check whether the MS16-135 fix is already present from an elevated PowerShell prompt. On Windows 10 / Server 2016 the fix arrived in the November 2016 cumulative update, so any later monthly update also carries it:

# Show the most recently installed updates and their dates
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 15 HotFixID, InstalledOn

# The MS16-135 KBs by product family:
#   Windows 10 1607 / Server 2016 ......... KB3200970 (cumulative)
#   Windows 10 1511 ....................... KB3198586 (cumulative)
#   Windows 10 RTM ........................ KB3198585 (cumulative)
#   Windows 8.1 / Server 2012 R2 .......... KB3197873 (security-only) or KB3197874 (rollup)
#   Windows Server 2012 ................... KB3197876 (security-only) or KB3197877 (rollup)
#   Windows 7 SP1 / Server 2008 R2 SP1 .... KB3197867 (security-only) or KB3197868 (rollup)
#   Windows Vista / Server 2008 SP2 ....... KB3197867-class standalone Win32k update

# Confirm a specific KB is installed (example for Server 2016):
Get-HotFix -Id KB3200970 -ErrorAction SilentlyContinue

If Get-HotFix shows any update installed after November 2016 for Windows 10 / Server 2016, you are covered, because those cumulative updates are superseding. For Windows 7 / 8.1 and their server siblings, either the monthly rollup or the security-only KB above must be present.

How to fix CVE-2016-7255

The fix is the Microsoft November 2016 update. There is no Win32k configuration toggle and no third-party package to manage: you apply a Windows update and reboot. Pick the path that matches how you manage patches.

Option 1, Windows Update (single machine)

The simplest path. Run Windows Update and install everything offered, then reboot. Because the post-November-2016 cumulative updates supersede MS16-135, a fully patched machine is already remediated.

# Trigger a scan and install from an elevated PowerShell prompt
# (built-in on Windows; uses the Windows Update agent)
Start-Process "$env:SystemRoot\System32\UsoClient.exe" -ArgumentList "StartScan"

# Then install via Settings > Windows Update > Check for updates, or with the
# PSWindowsUpdate module if you have it:
#   Install-Module PSWindowsUpdate -Scope CurrentUser
#   Get-WindowsUpdate -AcceptAll -Install -AutoReboot

Option 2. Standalone KB from the Microsoft Update Catalog

Use this for isolated, air-gapped, or end-of-life hosts (Windows 7, Server 2008 R2, Vista) where you want exactly the MS16-135 fix and nothing else. Download the matching KB for your OS and architecture from the Microsoft Update Catalog, then install the .msu silently:

# Example: install the downloaded MS16-135 security-only update on Windows 7 x64
# (KB3197867, replace with the KB that matches the table above for your OS)
wusa.exe C:\Patches\windows6.1-kb3197867-x64.msu /quiet /norestart

# Reboot to load the patched win32k.sys into the kernel
Restart-Computer

Download links live at the Microsoft Update Catalog (https://www.catalog.update.microsoft.com): search the KB number from the table for your product.

Option 3, WSUS / SCCM / Intune (fleet)

For managed estates, approve the November 2016 (or any later) cumulative update / monthly rollup for the affected collections and let the normal maintenance window deploy it. Win32k changes require a reboot to take effect, so make sure the deployment forces or schedules one.

# Verify across a fleet with PowerShell remoting: list hosts MISSING the fix.
# Adjust the cutoff date to your patch baseline.
$cutoff = Get-Date '2016-11-08'
$servers = Get-Content .\servers.txt
Invoke-Command -ComputerName $servers -ScriptBlock {
    $latest = (Get-HotFix | Sort-Object InstalledOn -Descending |
               Select-Object -First 1).InstalledOn
    [pscustomobject]@{ Host = $env:COMPUTERNAME; LatestPatch = $latest }
} | Where-Object { $_.LatestPatch -lt $using:cutoff } |
    Sort-Object LatestPatch | Format-Table -AutoSize

If you can't patch immediately

Microsoft published no workaround for CVE-2016-7255. the bulletin lists patching as the only fix, and there is no registry key or feature toggle that disables the vulnerable Win32k path. If you cannot deploy the update on a host yet, you can only reduce the odds of the first stage that delivers the local attacker:

• Block the delivery vector. The real-world chain started with a Flash zero-day and malicious documents. Remove or disable Adobe Flash where it still exists, enforce Office macro blocking, and restrict which users can run arbitrary executables. No local foothold means no path to trigger Win32k.
• Run users as standard, not local admin. The exploit elevates from a normal user to SYSTEM, so least privilege does not stop it outright, but it does keep the pre-exploitation foothold contained and makes lateral movement harder.
• Watch for the post-exploitation signal. Successful exploitation results in a normal process suddenly running as SYSTEM. Alert on unexpected parent/child process trees and token elevation on workstations, especially Office or browser children spawning SYSTEM-level processes.

These are stopgaps. Because this CVE is in the CISA KEV catalog and was used by a nation-state actor, treat the patch as an emergency change and schedule the reboot, not a “next cycle” item.

Verify the fix

After the update installs and the machine reboots, confirm the patched win32k.sys is loaded and the expected KB is present:

# 1. Confirm the KB that carries the fix is installed (use the KB for your OS)
Get-HotFix -Id KB3200970   # example: Server 2016 / Windows 10 1607

# 2. Confirm the running win32k.sys file version is post-November-2016
Get-Item "$env:SystemRoot\System32\win32k.sys" |
    Select-Object Name, VersionInfo

# 3. On 64-bit Windows the GDI driver may be win32kbase.sys / win32kfull.sys:
Get-ChildItem "$env:SystemRoot\System32\win32k*.sys" |
    ForEach-Object { $_.Name + '  ' + $_.VersionInfo.FileVersion }

The file version date on win32k.sys (or win32kfull.sys on newer builds) should be November 2016 or later. Then re-run your vulnerability scanner and confirm the CVE-2016-7255 finding has cleared. If the host was reachable during the 2016 disclosure window and was unpatched, hunt for signs of post-exploitation: unexplained SYSTEM-level processes, new scheduled tasks, or services created shortly after a user logged in.

Frequently asked questions

Which Microsoft update fixes CVE-2016-7255?

Microsoft security bulletin MS16-135, released on 8 November 2016 Patch Tuesday. On Windows 10 and Server 2016 it ships inside that month's cumulative update (for example KB3200970 on 1607 / Server 2016); on Windows 7, 8.1, Vista and Server 2008/2012 it is a standalone Win32k kernel-mode driver update or the monthly rollup. Installing any Windows update from November 2016 or later remediates it.

Is CVE-2016-7255 a remote code execution bug?

No. It is a local elevation of privilege flaw in the Win32k kernel-mode driver. The attacker must already run code on the machine as a normal user; a crafted application then abuses Win32k to execute in kernel mode and gain SYSTEM. It cannot be exploited directly over the network: that is why it was paired with a Flash zero-day to get the initial foothold.

Was CVE-2016-7255 exploited in the wild?

Yes. Google and Microsoft disclosed that the APT28 / STRONTIUM group used it as the privilege-escalation half of a two-stage chain, behind Adobe Flash zero-day CVE-2016-7855, before the patch shipped. CISA added CVE-2016-7255 to its Known Exploited Vulnerabilities catalog on 3 November 2021, with a federal remediation deadline of 3 May 2022.

I am still on Windows 7 or Server 2008 R2. Can I still get the fix?

Yes. Those products are end of life now, but MS16-135 was published while they were supported, so the standalone KB (for example KB3197867 on Windows 7 SP1 / Server 2008 R2 SP1) is still downloadable from the Microsoft Update Catalog. If any monthly rollup after November 2016 has been applied, the fix is already in place. Plan to move off end-of-life Windows, because newer kernel bugs on those builds will never be patched.

References

• Official vendor advisory: https://github.com/mwrlabs/CVE-2016-7255
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2016-7255
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Additional reference: http://packetstormsecurity.com/files/140468/Microsoft-Windows-Kernel-win32k.sys-NtSetWindowLongPtr-Privilege-Escalation.html
• Additional reference: https://www.exploit-db.com/exploits/40823/
• Additional reference: https://www.exploit-db.com/exploits/41015/

Written by Sai Kiran Pandrala on 2026-05-25. Sourced from the official vendor advisory, the NVD record, and the CISA KEV listing. Always confirm against the vendor advisory before applying changes in production.

Related fixes

Nearby vulnerabilities you may as well remediate alongside this fix:

• How to Fix CVE-2016-3976: Path traversal in SAP NetWeaver AS Java
• How to Fix CVE-2016-2388: Exposure of Sensitive Information to an Unauthorized Actor in Netweaver
• How to Fix CVE-2016-3714: Security Vulnerability in ImageMagick
• How to Fix CVE-2016-20017: Improper Neutralization of Special Elements used in a Command ('Command Injectio
• How to Fix CVE-2016-0185: Remote code execution in Microsoft Windows Media Center