Skip to content
Fencer Intel
low 1.9

CVE-2015-0010 json

The CryptProtectMemory function in cng.sys (aka the Cryptography Next Generation driver) in the kernel-mode drivers in Microsoft Windows Se…

published 2015-02-11 11 y ago modified 2026-06-17 4 mo ago also EUVD-2015-0048

cvss
1.9
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.5%
EPSS 2.5% chance of exploitation in 30 days, percentile 85%
public exploits
1
Exploit-DB

Summary

The CryptProtectMemory function in cng.sys (aka the Cryptography Next Generation driver) in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1, when the CRYPTPROTECTMEMORY_SAME_LOGON option is used, does not check an impersonation token's level, which allows local users to bypass intended decryption restrictions by leveraging a service that (1) has a named-pipe planting vulnerability or (2) uses world-readable shared memory for encrypted data, aka "CNG Security Feature Bypass Vulnerability" or MSRC ID 20707.

Patch / fix

Timeline

  1. Published
  2. First public exploit (EDB-37098)

Exploit prediction

2.54% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • EDB-37098 Microsoft Windows - Local Privilege Escalation (MS15-010) local, 2015-05-25
  • code.google.com http://code.google.com/p/google-security-research/issues/detail?id=128 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 1.9 AV:L/AC:M/Au:N/C:P/I:N/A:N

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.