CVE-2016-0099: Microsoft Windows Secondary Logon Service Privilege Escalation Vulnerability

Vulnerability summary

CVE-2016-0099 is a high (CVSS 7.8) Classic Buffer Overflow vulnerability in Microsoft Windows. It is known to be exploited: CISA lists it, first on 03-03-2022. It has been used in ransomware campaigns. EPSS estimates a 37.05% chance of exploitation in the next 30 days, higher than 98.5% of scored vulnerabilities. 5 public exploits are recorded.

Timeline

1. 09-03-2016
   PublishedVulnerability first disclosed.
2. 03-03-2022
   Added to CISA KEVMicrosoft Windows Secondary Logon Service Privilege Escalation Vulnerability
3. 24-03-2022
   CISA remediation dueApply updates per vendor instructions.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 does not properly process request handles, which allows local users to gain privileges via a crafted application, aka "Secondary Logon Elevation of Privilege Vulnerability."

• CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.