EXPOSURES › CVE-2013-3660
CVE-2013-3660
HIGH ⌖ ON CISA KEV · EXPLOITEDA local privilege escalation vulnerability in Microsoft's Win32k.sys allowed attackers to escalate privileges via a pointer initialization flaw.
This unpatched vulnerability in the Windows kernel allowed local users to escalate privileges, which could lead to full system compromise. DIB organizations must ensure all Windows systems are patched against known CVEs, as this flaw was actively exploited in the wild despite being disclosed years ago. The failure highlights the risk of relying on unpatched legacy systems and the importance of rigorous patch management.
Shame score — Microsoft failed to patch a known vulnerability for years, allowing it to be actively exploited in the wild, which is a severe negligence issue.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft does not properly initialize a pointer for the next object in a certain list, which allows local users to gain privileges.
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |