CVE-2018-8639

high-risk

Published 2018-12-12

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8641.

Do I need to act?

33.2% chance of exploitation in next 30 days

EPSS score — higher than 67% of all CVEs

CISA KEV: actively exploited in the wild

On the Known Exploited Vulnerabilities catalog — federal agencies must patch

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.8/10 High

LOCAL / LOW complexity

Affected Products (17)

Windows 10 1507

Windows 10 1607

Windows 10 1703

Windows 10 1709

Windows 10 1803

Windows 10 1809

Windows 7

Windows 8.1

Windows Rt 8.1

Windows Server 2008

Windows Server 2012

Windows Server 2016

Windows Server 2019

Affected Vendors

Microsoft

References (5)

Broken Link http://www.securityfocus.com/bid/106093

Patch https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8639

Broken Link http://www.securityfocus.com/bid/106093

Patch https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8639

US Government Resource https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-...

/ 100

high-risk

Severity 24/34 · High

Exploitability 23/34 · High

Exposure 19/34 · Moderate