CVE-2018-8405KEV · OVERDUE

Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability

High · published August 15, 2018

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 88.9th percentile for exploit probability.

1648
days past CISA
deadline
CVSS v3.1
7.8
EPSS
3%
Percentile
88.9
In the wild
Confirmed
What it is

⚡ A critical privilege escalation flaw makes the DirectX Graphics Kernel a sneaky door to an elevated access level! 🚪💥 Think of it like a hotel keycard that lets you access any room in the building, rather than just your own — once the attacker slips through the front door, they can roam freely. This is what happens when the DXGKRNL driver mishandles memory objects, allowing unauthorized access to the system. An attacker could exploit this vulnerability to gain elevated privileges, potentially allowing them to execute arbitrary code with higher access than intended. This could lead to complete system compromise, making it a serious threat for all users, especially those running the affected Windows versions.

Put simply

Think of it like a hotel keycard that lets you access any room in the building, rather than just your own — once the attacker slips through the front door, they can roam freely. This is what happens when the DXGKRNL driver mishandles memory objects, allowing unauthorized access to the system. This elevation of privilege vulnerability in the DirectX Graphics Kernel occurs due to improper handling of memory objects, allowing attackers to gain elevated rights within the system. This bug affects multiple Windows operating systems including Windows Server 2012 R2 and Windows 10.

What to do

An attacker could exploit this vulnerability to gain elevated privileges, potentially allowing them to execute arbitrary code with higher access than intended. This could lead to complete system compromise, making it a serious threat for all users, especially those running the affected Windows versions. To protect against this vulnerability, update your systems immediately to the latest patches provided by Microsoft. Regularly check for updates and ensure your security policies are enforced to minimize risks. You've got this! Stay vigilant and patch up those systems to keep your digital fortress safe! 🛡️✨

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03444 · 88.9th percentile
Published
2018-08-15T17:00Z
KEV added
2022-03-28 · due 2022-04-18
EPSS history
Timeline
  • 28 MAR 00:00Z
    Added to CISA KEV — remediate by Apr 18
    kev
  • 15 AUG 17:00Z
    An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics…
    cvelistv5