Vulnerability Spotlight: Local Code Execution via the Intel HD Graphics Windows Kernel Driver

Summary: Cisco Talos disclosed TALOS-2016-0087 (CVE-2016-5647), a local arbitrary code execution vulnerability in the Intel HD Graphics Windows Kernel Mode Driver that is triggered by sending a specially crafted D3DKMTEscape request, resulting in a NULL dereference. On Windows 7 and earlier, exploitation yields arbitrary code execution in the SYSTEM context via mapping the NULL page through the NTVDM subsystem, while on Windows 8 and later it would likely only cause a system crash, since NTVDM was removed or is disabled by default.
What you should know: The flaw's severity turns entirely on which Windows version sits in front of it: SYSTEM-level code execution on Windows 7 and earlier versus a likely denial of service on Windows 8 and later, so legacy machines kept for application compatibility carry the full risk. Talos notes those newer mitigations are not foolproof, since another driver could be manipulated into placing user-controlled data at the NULL page.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2016-5647
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026