CVEvulnerability

CVE-2010-4398

7.8 HIGH Known exploited Published 2010-12-06 Modified 2026-06-16 Official page ↗

CISA Known Exploited Vulnerability

Microsoft Windows Kernel Stack-Based Buffer Overflow Vulnerability — Microsoft Windows

Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows allows local users to gain privileges, and bypass the User Account Control (UAC) feature.

Added to KEV: 2022-03-28
Remediation due: 2022-04-21
Ransomware use: Unknown
Required action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2010-4398

Status: Analyzed
Published: 2010-12-06
Last modified: 2026-06-16
Assigner: [email protected]
CVSS 3.1 ([email protected]): 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected]): 7.2 HIGH — AV:L/AC:L/Au:N/C:C/I:C/A:C
Weaknesses: CWE-787

Description

Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows local users to gain privileges, and bypass the User Account Control (UAC) feature, via a crafted REG_BINARY value for a SystemDefaultEUDCFont registry key, aka "Driver Improper Interaction with Windows Kernel Vulnerability."

Affected configurations

• microsoft windows 7 • microsoft windows server 2003 • microsoft windows server 2008 • microsoft windows server 2008 r2 • microsoft windows vista • microsoft windows xp

Related

Weakness · CWE (1)

CWE-787 Out-of-bounds Write weakness

References

http://isc.sans.edu/diary.html?storyid=9988 Exploit, Issue Tracking
http://nakedsecurity.sophos.com/2010/11/25/new-windows-zero-day-flaw-bypasses-uac/ Broken Link
http://secunia.com/advisories/42356 Broken Link, Vendor Advisory
http://support.avaya.com/css/P8/documents/100127248 Third Party Advisory
http://twitter.com/msftsecresponse/statuses/7590788200402945 Not Applicable
http://www.exploit-db.com/bypassing-uac-with-user-privilege-under-windows-vista7-mirror/ Broken Link, Exploit, Third Party Advisory, VDB Entry
http://www.exploit-db.com/exploits/15609/ Exploit, Third Party Advisory, VDB Entry
http://www.kb.cert.org/vuls/id/529673 Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/45045 Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1025046 Broken Link, Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2011/0324 Broken Link
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-011 Patch, Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12162 Broken Link
http://isc.sans.edu/diary.html?storyid=9988 Exploit, Issue Tracking
http://nakedsecurity.sophos.com/2010/11/25/new-windows-zero-day-flaw-bypasses-uac/ Broken Link
http://secunia.com/advisories/42356 Broken Link, Vendor Advisory
http://support.avaya.com/css/P8/documents/100127248 Third Party Advisory
http://twitter.com/msftsecresponse/statuses/7590788200402945 Not Applicable
http://www.exploit-db.com/bypassing-uac-with-user-privilege-under-windows-vista7-mirror/ Broken Link, Exploit, Third Party Advisory, VDB Entry
http://www.exploit-db.com/exploits/15609/ Exploit, Third Party Advisory, VDB Entry
http://www.kb.cert.org/vuls/id/529673 Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/45045 Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1025046 Broken Link, Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2011/0324 Broken Link
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-011 Patch, Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12162 Broken Link
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-4398 US Government Resource