Oval Definition:oval:org.cisecurity:def:1485
Revision Date:2016-12-30Version:17
Title:Win32k Elevation of Privilege Vulnerability - CVE-2016-7246 (MS16-135)
Description:The kernel-mode drivers in Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
Family:windowsClass:vulnerability
Status:ACCEPTEDReference(s):CVE-2016-7246
Platform(s):Microsoft Windows 10
Microsoft Windows 7
Microsoft Windows 8.1
Microsoft Windows Server 2008 R2
Microsoft Windows Server 2012
Microsoft Windows Server 2012 R2
Microsoft Windows Server 2016
Product(s):
Definition Synopsis
  • Win7/2008 R2 + file version
  • Win7/2008 R2
  • Microsoft Windows 7 (32-bit) Service Pack 1 is installed
  • OR Microsoft Windows 7 x64 Service Pack 1 is installed
  • OR Microsoft Windows Server 2008 R2 x64 Service Pack 1 is installed
  • OR Microsoft Windows Server 2008 R2 Itanium-Based Edition Service Pack 1 is installed
  • AND file version
  • Check if the version of Win32k.sys is less than 6.1.7601.23584
  • OR 2012 + file version
  • Microsoft Windows Server 2012 is installed
  • AND Check if the version of Win32k.sys is less than 6.2.9200.22023
  • OR Win8.1/2012 R2 + file version
  • Win8.1/2012 R2
  • Microsoft Windows 8.1 (x86) is installed
  • OR Microsoft Windows 8.1 (x64) is installed
  • OR Microsoft Windows Server 2012 R2 is installed
  • AND file version
  • Check if the version of Win32k.sys is less than 6.3.9600.18524
  • OR Win10 + file version
  • Win10
  • Microsoft Windows 10 (x86) is installed
  • OR Microsoft Windows 10 (x64) is installed
  • AND file version
  • Check if Win32k.sys version is less than 10.0.10240.16384
  • OR 1511 + file version
  • Win10
  • Microsoft Windows 10 Version 1511 (32-bit) is installed
  • OR Microsoft Windows 10 Version 1511 (64-bit) is installed
  • AND file version
  • Check if Win32k.sys version is less than 10.0.10586.20
  • OR 1607/2016 + file version
  • 1607/2016
  • Microsoft Windows 10 Version 1607 (32-bit) is installed
  • OR Microsoft Windows 10 Version 1607 (64-bit) is installed
  • OR Microsoft Windows Server 2016 is installed
  • AND file version
  • Check if the version of Win32k.sys is less than 10.0.14393.447
  • BACK