ZeroDay Findings
Sign inSign up

Findings

CVE-2010-4398

Microsoft Windows Kernel Stack-Based Buffer Overflow Vulnerability

Published Dec 3, 2010 · updated Jun 16, 2026 · n/a n/a

Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows local users to gain privileges, and bypass the User Account Control (UAC) feature, via a crafted REG_BINARY value for a SystemDefaultEUDCFont registry key, aka "Driver Improper Interaction with Windows Kernel Vulnerability."

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Dec 6, 2010 · Catalog

    Detected

    Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows local users to gain privileges, and bypass the User Account Control (UAC) feature, via a crafted REG_BINARY value for a SystemDefaultEUDCFont registry key, aka "Driver Im

  2. Mar 28, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Apr 21, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows local users to gain privileges, and bypass the User Account Control (UAC) feature, via a crafted REG_BINARY value for a SystemDefaultEUDCFont registry key, aka "Driver Im

Required action

Apply updates per vendor instructions.

CISA due date Apr 21, 2022

Affected

  • cpe microsoft/windows 7version unspecified
  • cpe microsoft/windows server 2003version unspecified
  • cpe microsoft/windows server 2008version unspecified
  • cpe microsoft/windows server 2008r2
  • cpe microsoft/windows vistaversion unspecified
  • cpe microsoft/windows xpversion unspecified
  • vendor Microsoft Windowsversion unspecified
  • vendor n/a n/aversion unspecified

Sources

  • CISA KEVConfirmed exploitationCVE-2010-4398

    Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows allows local users to gain privileges, and bypass the User Account Control (UAC) feature.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2010-4398

    Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows local users to gain privileges, and bypass the Use

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2010-4398

    30-day exploitation probability 8.7%

    first.org
  • Exploit DatabasePublic exploit reference15609

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • NIST NVDVulnerability recordCVE-2010-4398

    Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows local users to gain privileges, and bypass the Use

    nvd.nist.gov

References