Is CVE-2010-4398 being actively exploited?

Yes. CVE-2010-4398 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on March 28, 2022.

What is the CVSS score for CVE-2010-4398?

CVE-2010-4398 has a CVSS 3.1 base score of 7.8 (HIGH).

CVE-2010-4398

HIGH · CVSS 7.8CISA KEV: actively exploitedEPSS 8.7%EU EUVD: exploited

Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows local users to gain privileges, and bypass the User Account Control (UAC) feature, via a crafted REG_BINARY value for a SystemDefaultEUDCFont registry key, aka "Driver Improper Interaction with Windows Kernel Vulnerability."

Key facts

CVSS score: 7.8 (v3.1)
Severity: HIGH
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-787
EPSS score: 8.7% (95th percentile)
In CISA KEV: Yes, added March 28, 2022
In EU EUVD: Yes (EUVD-2010-4367)
Published: December 6, 2010
NVD last modified: June 16, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Microsoft Windows Kernel Stack-Based Buffer Overflow Vulnerability

Added to the KEV catalog on March 28, 2022; federal remediation due April 21, 2022.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2010-4367 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on October 22, 2025.

View on the EU Vulnerability Database

Affected products

microsoft / windows 7
microsoft / windows server 2003
microsoft / windows server 2008
microsoft / windows server 2008
microsoft / windows server 2008
microsoft / windows vista
microsoft / windows vista
microsoft / windows xp
microsoft / windows xp

Certified products that may be affected

28 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

Microsoft Windows Server 2008 R2 Hyper-V Release 6.1.7600 - Microsoft Corporation - Common Criteria BSI-DSZ-CC-0755-2012 - archived
Microsoft Windows 7, Microsoft Windows Server 2008 R2 - Microsoft Corporation - Common Criteria CCEVS-VR-10390-2010 - archived
Windows 7 BitLocker™ Drive Encryption - Microsoft Corporation - FIPS 140 1332 - historical
Windows Server 2008 R2 BitLocker™ Drive Encryption - Microsoft Corporation - FIPS 140 1339 - historical
Windows Server 2008 R2 Enhanced Cryptographic Provider (RSAENH) - Microsoft Corporation - FIPS 140 1337 - historical

See all 28 in the Security Certifications Explorer.

References

http://isc.sans.edu/diary.html?storyid=9988(Exploit, Issue Tracking)
http://nakedsecurity.sophos.com/2010/11/25/new-windows-zero-day-flaw-bypasses-uac/(Broken Link)
http://secunia.com/advisories/42356(Broken Link, Vendor Advisory)
http://support.avaya.com/css/P8/documents/100127248(Third Party Advisory)
http://twitter.com/msftsecresponse/statuses/7590788200402945(Not Applicable)
http://www.exploit-db.com/bypassing-uac-with-user-privilege-under-windows-vista7-mirror/(Broken Link, Exploit, Third Party Advisory, VDB Entry)
http://www.exploit-db.com/exploits/15609/(Exploit, Third Party Advisory, VDB Entry)
http://www.kb.cert.org/vuls/id/529673(Third Party Advisory, US Government Resource)
http://www.securityfocus.com/bid/45045(Broken Link, Third Party Advisory, VDB Entry)
http://www.securitytracker.com/id?1025046(Broken Link, Third Party Advisory, VDB Entry)
http://www.vupen.com/english/advisories/2011/0324(Broken Link)
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-011(Patch, Vendor Advisory)
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12162(Broken Link)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-4398(US Government Resource)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain