MS16-032 Secondary Logon Elevation of Privilege

CVE-2016-0099 is a local elevation-of-privilege vulnerability in the Windows Secondary Logon Service, caused by incorrect management of request handles in memory. A logged-on local user could run a specially crafted application to exploit the flaw and execute code with administrator privileges. Public proof-of-concept implementations use a handle/token race; their exact outcome depends on the affected Windows build. The vulnerability is addressed by Microsoft's MS16-032 updates and applicable superseding updates.