Skip to content
Fencer Intel
high 7.8

CVE-2010-4398 kev in the critical feed json

Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 S…

published 2010-12-03 15 y ago modified 2026-06-16 4 mo ago also EUVD-2010-4367

cvss
7.8
version 3.1, CNA
cisa kev
Exploited
added 2022-03-28
epss
8.7%
EPSS 8.7% chance of exploitation in 30 days, percentile 95%
public exploits
1
Exploit-DB

Summary

Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows local users to gain privileges, and bypass the User Account Control (UAC) feature, via a crafted REG_BINARY value for a SystemDefaultEUDCFont registry key, aka "Driver Improper Interaction with Windows Kernel Vulnerability."

Patch / fix

cisa required action Apply updates per vendor instructions.

Timeline

  1. First public exploit (EDB-15609)
  2. Published
  3. Added to CISA KEV
  4. CISA patch deadline
  5. CISA SSVC: exploitation active

Known exploited

Added
4 y ago
Patch by
2022-04-21 (4 y ago)
Ransomware
Not known
Required action
Apply updates per vendor instructions.
Vendor, product
Microsoft, Windows
CISA name
Microsoft Windows Kernel Stack-Based Buffer Overflow Vulnerability

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
no
Technical impact
total
Assessed
20 mo ago

Exploit prediction

8.66% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • EDB-15609 Microsoft Windows Vista/7 - Local Privilege Escalation (UAC Bypass) local, 2010-11-24
  • isc.sans.edu http://isc.sans.edu/diary.html?storyid=9988 referenced PoC, tagged "exploit" by a source, unverified
  • exploit-db.com http://www.exploit-db.com/bypassing-uac-with-user-privilege-under-windows-vista7-mirror/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.