CVE-2010-4398

CVE-2010-4398 is a high-severity (CVSS 7.8) vulnerability in Microsoft Windows. CISA added it to the Known Exploited Vulnerabilities catalog on March 28, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by April 21, 2022. CISA does not currently list it as used in ransomware campaigns. Microsoft has 390 vulnerabilities in the KEV catalog, 117 of them linked to ransomware.

Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows local users to gain privileges, and bypass the User Account Control (UAC) feature, via a crafted REG_BINARY value for a SystemDefaultEUDCFont registry key, aka "Driver Improper Interaction with Windows Kernel Vulnerability."

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• http://isc.sans.edu/diary.html?storyid=9988
• http://nakedsecurity.sophos.com/2010/11/25/new-windows-zero-day-flaw-bypasses-uac/
• http://secunia.com/advisories/42356
• http://support.avaya.com/css/P8/documents/100127248
• http://twitter.com/msftsecresponse/statuses/7590788200402945
• http://www.exploit-db.com/bypassing-uac-with-user-privilege-under-windows-vista7-mirror/
• http://www.exploit-db.com/exploits/15609/
• http://www.kb.cert.org/vuls/id/529673