CVE-2016-0151VulnerabilityPublished 03/28/2022Updated 10/24/2026

CVE-2016-0151: Microsoft Windows CSRSS Security Feature Bypass Vulnerability

Affects Microsoft Client-Server Run-time Subsystem (CSRSS)Source CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 03/28/2022
KEV deadline: 04/18/2022
Ransomware: Used in ransomware campaigns
EPSS: 62.9% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2016-0151 (opens in a new tab)

Description

CVE-2016-0151 is a security feature bypass vulnerability in the Microsoft Windows Client-Server Run-time Subsystem (CSRSS). It involves improper management of process tokens, allowing local users to escalate privileges by running crafted applications. This vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns. No specific affected versions or patch information is provided in the available data.

Summary

The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows improperly manages process tokens, which enables local users to bypass security features and gain elevated privileges by executing specially crafted applications. This vulnerability, tracked as CVE-2016-0151, has been observed in active exploitation scenarios, including ransomware campaigns. The lack of explicit patch or remediation details in the provided data means patch status is not confirmed and should be verified with Microsoft advisories.

Impact

Local users can exploit this vulnerability to escalate privileges on affected Windows systems, potentially gaining unauthorized elevated access. This can facilitate further malicious activities such as ransomware deployment. The vulnerability has been exploited in the wild, indicating active threat use.

Mitigation

Patch status is not yet confirmed — check the Microsoft vendor advisory for current remediation guidance. Until a patch is applied, restrict local user permissions and monitor for suspicious local activity related to CSRSS processes.

Weaknesses

CWE-264Unclassified weakness (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 11:11:47 UTC

Weaknesses

References

Related threats