CVE-2015-2546VulnerabilityPublished 03/15/2022Updated 10/24/2026

CVE-2015-2546: Microsoft Win32k Memory Corruption Vulnerability

Affects Microsoft Win32kSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 03/15/2022
KEV deadline: 04/05/2022
Ransomware: Used in ransomware campaigns
EPSS: 10.1% chance of exploitation in 30 days – higher than 95% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2015-2546 (opens in a new tab)

Description

CVE-2015-2546 is a memory corruption vulnerability in the Microsoft Windows kernel-mode driver Win32k. It allows local users to gain elevated privileges by executing a crafted application. The vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns.

Summary

This vulnerability exists in the Win32k kernel-mode driver of Microsoft Windows OS and Server. It enables local attackers to corrupt memory, leading to privilege escalation. The flaw is identified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). Exploitation requires local access and involves running a specially crafted application to trigger the vulnerability.

Impact

Successful exploitation allows local users to escalate privileges, potentially gaining SYSTEM-level access. This can facilitate further malicious activities such as ransomware deployment. The vulnerability has been confirmed to be exploited in the wild, indicating active threat usage.

Mitigation

No explicit patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the Microsoft vendor advisory for current remediation guidance. Given the known exploitation, applying official Microsoft security updates addressing this vulnerability is strongly recommended once available.

Weaknesses

CWE-119Buffer Errors (Memory Bounds) (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 10:42:12 UTC

Weaknesses

References

Related threats