CVE-2016-0165

What Is Win32k.sys?

Win32k.sys is the Windows kernel-mode driver that implements the Win32 user interface subsystem — including GDI (Graphics Device Interface) graphics rendering, window management, and the USER component handling desktop windows and user input. Running in kernel mode (ring 0) with unrestricted system access, Win32k exposes thousands of system call entry points accessible from user-space applications. Historically, Win32k has been the most prolific source of Windows privilege escalation vulnerabilities, providing a massive kernel-mode attack surface reachable from any user-space process.

Overview

CVE-2016-0165 is a privilege escalation vulnerability in the Windows Win32k kernel-mode graphics driver that allows a local attacker to gain SYSTEM-level privileges via a specially crafted application. The vulnerability is addressed in MS16-039 (April 12, 2016), which also addressed CVE-2016-0167, CVE-2016-0145, and other Win32k LPE issues in the same update. CISA added CVE-2016-0165 to the KEV catalog in June 2023 — over seven years after the patch — confirming sustained exploitation against legacy Windows deployments.

Affected Versions

Fixed in MS16-039 (April 2016 Patch Tuesday).

Technical Details

Root Cause: Win32k Kernel Driver Privilege Escalation

CVE-2016-0165 involves an unspecified privilege escalation flaw in Win32k's graphics processing code. Win32k LPE vulnerabilities typically fall into these categories:

• Pool overflow — writing beyond a kernel pool allocation, corrupting adjacent kernel objects
• Use-after-free — using a freed kernel object through a stale pointer, enabling controlled kernel memory write
• Null pointer dereference with mapping — exploiting a null dereference by mapping the null page with controlled data
• Race condition — a time-of-check to time-of-use (TOCTOU) race in object reference counting

Regardless of the specific technical class, Win32k LPE exploitation follows a consistent pattern:

1. Trigger the vulnerability via Win32 API calls from user-space
2. Corrupt a kernel pool object to gain a write primitive
3. Overwrite an EPROCESS token — the security token of the attacking process's kernel structure
4. Achieve SYSTEM — the process token is replaced with the SYSTEM token, granting full system access

Attack Characteristics

Discovery

Reported to Microsoft and patched in MS16-039 (April 2016 Patch Tuesday). CVE-2016-0165 was patched in the same bulletin as CVE-2016-0167 — both Win32k LPEs that were confirmed as actively exploited.

Exploitation Context

• Win32k LPE class: CVE-2016-0165 is part of a long series of Win32k privilege escalation vulnerabilities patched throughout 2014–2019; attackers maintained a portfolio of Win32k LPEs and used them interchangeably depending on target patch level, rotating to newer CVEs as older ones were patched
• Long exploitation tail: CISA's June 2023 KEV addition — 7+ years after the patch — reflects that unpatched Windows installations (including Windows 7 systems running past their January 2020 EOL date) remain exploitation targets; attackers specifically seek Win32k LPEs for these legacy systems
• Paired with CVE-2016-0167: CVE-2016-0165 and CVE-2016-0167 were patched in the same MS16-039 bulletin, suggesting both were discovered or reported in close proximity, possibly as alternative exploitation paths for Win32k vulnerabilities
• CISA KEV (2023): Added June 2023

Remediation

1. Apply MS16-039 (April 2016). Any Windows system current with Windows Update after April 2016 includes this fix.

2. Upgrade end-of-life Windows — Windows 7 and Server 2008 are past EOL and cannot receive further security updates. Upgrade to Windows 10/11 or Server 2019/2022.

3. Enable Virtualization Based Security (VBS) / HVCI — Hypervisor-Protected Code Integrity isolates kernel code integrity verification, significantly raising the bar for Win32k exploitation on Windows 10 and later.

4. Win32k lockdown — Windows 10 Anniversary Update and later include Win32k API lockdown for processes that opt in, reducing the Win32k attack surface for high-value processes like browsers.