High severity · published Feb 10, 2016
CVE-2016-0041
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold and 1511, and…
7.8
CVSS
82.9%
EPSS
No
On KEV
Description
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold and 1511, and Internet Explorer 10 and 11 mishandle DLL loading, which allows local users to gain privileges via a crafted application, aka "DLL Loading Remote Code Execution Vulnerability."
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)82.9% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WI
Windows · Microsoft
1511 · source: NVD
IE
Internet Explorer · Microsoft
10; 11 · source: NVD
W7
Windows 7 · Microsoft
All versions, or not specified · source: NVD
W8
Windows 8.1 · Microsoft
All versions, or not specified · source: NVD
WR
Windows RT 8.1 · Microsoft
All versions, or not specified · source: NVD
WS
Windows Server 2008 · Microsoft
r2 · source: NVD
WS
Windows Server 2012 · Microsoft
r2 · source: NVD
WV
Windows Vista · Microsoft
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-0041
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-0041
seclists.org
http://seclists.org/fulldisclosure/2016/Feb/49
www.securitytracker.com
http://www.securitytracker.com/id/1034971
www.securitytracker.com
http://www.securitytracker.com/id/1034985
docs.microsoft.com
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-009
docs.microsoft.com
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-014
www.securify.nl
https://www.securify.nl/advisory/SFY20150905/nps_datastore_server_dll_side_loading_vulnerability.html
More from Windows
10.0
CVE-2020-1350
Microsoft Windows DNS Server Remote Code Execution Vulnerability
9.8
CVE-2025-59287
Windows Server Update Service (WSUS) Remote Code Execution Vulnerability
9.8
CVE-2019-0708
Microsoft Remote Desktop Services Remote Code Execution Vulnerability
9.8
CVE-2017-8543
Microsoft Windows Search Remote Code Execution Vulnerability
9.8
CVE-2008-4250
Microsoft Windows Buffer Overflow Vulnerability