CVE-2010-0232

What is the Windows NTVDM?

The Windows NT Virtual DOS Machine (NTVDM) is the Windows subsystem for running 16-bit MS-DOS and Windows 3.x applications on 32-bit x86 versions of Windows. NTVDM emulates a full x86 real-mode environment, including BIOS interrupt services, for legacy 16-bit programs. It was enabled by default on 32-bit Windows NT, 2000, XP, Vista, and 7 — though absent on 64-bit Windows editions (which don't support NTVDM at all). NTVDM runs in a special kernel-supported mode that bridges ring-3 user space and ring-0 kernel code for BIOS call emulation, creating a complex privilege boundary that proved exploitable.

Overview

CVE-2010-0232 is a high-severity local privilege escalation vulnerability (CVSS 7.8) in the Windows kernel when 16-bit application support (NTVDM) is enabled on 32-bit x86 systems. The kernel's BIOS call emulation code failed to properly validate certain BIOS calls from 16-bit applications, allowing a local low-privileged user to gain kernel-level privileges. The vulnerability was publicly disclosed before the patch, giving attackers advance notice. Microsoft patched it in MS10-015 (February 2010 Patch Tuesday). CISA added to KEV in March 2022.

Affected Versions

Note: 64-bit Windows editions are not affected as they do not support NTVDM.

Technical Details

The vulnerability exists in the Windows kernel's handling of BIOS interrupt calls (INT instructions) issued by 16-bit code running within NTVDM. When a 16-bit application triggers a software interrupt (such as INT 0x10 for video services, INT 0x21 for DOS services, or other BIOS/DOS interrupt numbers), the Windows kernel intercepts the interrupt and emulates the corresponding BIOS service.

In the vulnerable code path, the kernel's exception handler for these BIOS call emulations improperly validated certain parameter values or processor state. An attacker could craft a 16-bit program that issued specific BIOS calls with carefully constructed parameters, causing the kernel exception handler to execute code with elevated privileges.

The exploitation path:

1. Attacker has local code execution at a standard user privilege level
2. Attacker runs a crafted 16-bit program (or injects code into an NTVDM session)
3. The program issues specially crafted BIOS interrupt calls
4. The kernel exception handler processes the call with insufficient validation
5. Attacker achieves code execution in kernel mode, gaining SYSTEM privileges

Discovery

Publicly disclosed by security researchers (the vulnerability was posted to security mailing lists) before Microsoft released a patch — a zero-day disclosure. Microsoft issued Security Advisory 979682 on January 19, 2010, acknowledging the vulnerability and providing a workaround (disabling NTVDM) while the patch was prepared. The February 2010 Patch Tuesday release of MS10-015 addressed the issue.

Exploitation Context

NTVDM privilege escalation vulnerabilities are valuable as post-exploitation primitives:

• Ubiquitous on 32-bit Windows: NTVDM was enabled by default on all 32-bit Windows versions, making this vulnerability universally applicable on any 32-bit Windows system an attacker encountered.
• Second-stage LPE: Attackers using this vulnerability would typically already have code execution at a standard user level, using CVE-2010-0232 to escalate to SYSTEM for credential harvesting, persistence, or further lateral movement.
• Legacy 32-bit systems: The March 2022 KEV addition reflects continued use of 32-bit Windows XP and Server 2003 in embedded and industrial environments where 16-bit application support remains enabled.
• Workaround availability: Even without the patch, Microsoft's workaround (disabling the NTVDM subsystem via Group Policy or registry) was effective — a useful compensating control for systems that couldn't be patched immediately.

Remediation

1. Apply MS10-015: Install the February 2010 Patch Tuesday cumulative update for affected Windows versions.
2. Disable NTVDM (workaround): If the patch cannot be applied immediately, disable 16-bit application support via Group Policy (Computer Configuration > Administrative Templates > Windows Components > Application Compatibility > "Prevent access to 16-bit applications") or registry.
3. Upgrade to 64-bit Windows: 64-bit Windows does not include NTVDM and is not affected by this class of vulnerability.
4. Migrate off legacy Windows: Windows XP and Server 2003 are end-of-life. Upgrade to supported Windows versions.