OMENWAVE modelled vulnerability-chaining pathways

CVE-2013-5065

NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in November 2013.

7.8
CVSS High
34.7%
EPSS p98
YES
In CISA KEV

Data as of 2 Nov 2026 · NVD, CISA KEV, EPSS

Why chaining, at machine speed

Defenders still triage vulnerabilities one CVE at a time, while increasingly automated attackers combine them at machine speed. Omenwave models the plausible pathways by which this CVE could be chained with others — surfacing them for research and awareness, with evidence for each step.

Modelled capability profile
Kill-chain stage
EXECUTION
Requires
NONE access, LOCAL vector, user interaction
Grants
USER access
Capabilities
code execution
Model confidence
medium · CVSS 3.1
Top plausible next hops
CVE-2010-2568EXECUTION → EXECUTIONhigh plausibility · KEV

The source lands the attacker on the host (code execution or an established foothold), which satisfies the destination's requirement for local access.

Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote att…

CVE-2012-0151EXECUTION → EXECUTIONhigh plausibility · KEV

The source lands the attacker on the host (code execution or an established foothold), which satisfies the destination's requirement for local access.

The Authenticode Signature Verification function in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008…

CVE-2015-1701EXECUTION → EXECUTIONhigh plausibility · KEV

The source lands the attacker on the host (code execution or an established foothold), which satisfies the destination's requirement for local access.

Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows local users to gain privileges via…

CVE-2013-3660EXECUTION → EXECUTIONhigh plausibility · KEV

The source lands the attacker on the host (code execution or an established foothold), which satisfies the destination's requirement for local access.

The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows V…

CVE-2011-2005EXECUTION → EXECUTIONhigh plausibility · KEV

The source lands the attacker on the host (code execution or an established foothold), which satisfies the destination's requirement for local access.

afd.sys in the Ancillary Function Driver in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly validate user-mode input passed to…

Open in the interactive explorer →
Embed this snapshot

Paste this into a blog post or report — it renders a compact, exploit-free chain snapshot.

Modelled plausible chaining potential derived from public CVE metadata (CVSS, CWE, CPE). Not a confirmed real-world exploit chain and contains no exploitation detail. For research and awareness only.

Methodology · Interactive explorer · JSON: /cve/CVE-2013-5065