What’s Vulnerable › Vulnerabilities

CVE-2010-4398: Microsoft Windows Kernel Stack-Based Buffer Overflow Vulnerability

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2022-03-28
• EPSS: 8.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2010-12-06 · updated 2026-06-16
• Weakness: CWE-787

Description

Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows local users to gain privileges, and bypass the User Account Control (UAC) feature, via a crafted REG_BINARY value for a SystemDefaultEUDCFont registry key, aka "Driver Improper Interaction with Windows Kernel Vulnerability."

Affected products

• Microsoft Windows 7: all versions
• Microsoft Windows Server 2003: all versions
• Microsoft Windows Server 2008: r2
• Microsoft Windows Vista: all versions
• Microsoft Windows XP Service Pack 3: all versions

References

• http://isc.sans.edu/diary.html?storyid=9988
• http://nakedsecurity.sophos.com/2010/11/25/new-windows-zero-day-flaw-bypasses-uac/
• http://secunia.com/advisories/42356
• http://support.avaya.com/css/P8/documents/100127248
• http://twitter.com/msftsecresponse/statuses/7590788200402945
• http://www.exploit-db.com/bypassing-uac-with-user-privilege-under-windows-vista7-mirror/
• http://www.exploit-db.com/exploits/15609/
• http://www.kb.cert.org/vuls/id/529673
• http://www.securityfocus.com/bid/45045
• http://www.securitytracker.com/id?1025046
• http://www.vupen.com/english/advisories/2011/0324
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-011

Get alerted when CVE-2010-4398 or the next vulnerability affects your stack