CVE-2018-8611KEV · OVERDUE

Microsoft Windows Kernel Privilege Escalation Vulnerability

High · published December 12, 2018

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 90.9th percentile for exploit probability.

1592
days past CISA
deadline
CVSS v3.1
7.8
EPSS
4%
Percentile
90.9
In the wild
Confirmed
What it is

🚨 If an attacker gets their hands on a specially crafted object, they can elevate their privileges and take control of your Windows machine! 🔥 Think of this vulnerability like a sneaky access card that lets someone into the server room without anyone checking their ID. They can then wander around and do as they please, totally unchecked! This means an attacker could gain elevated access rights, enabling them to install malicious software, steal sensitive information, or even take over the entire system. The potential for chaos is absolutely devastating if left unpatched!

Put simply

Think of this vulnerability like a sneaky access card that lets someone into the server room without anyone checking their ID. They can then wander around and do as they please, totally unchecked! This elevation of privilege vulnerability occurs when Windows kernel mishandles certain objects in memory, allowing attackers to gain unauthorized access to system resources.

What to do

This means an attacker could gain elevated access rights, enabling them to install malicious software, steal sensitive information, or even take over the entire system. The potential for chaos is absolutely devastating if left unpatched! To protect your systems, ensure you update to the latest patches provided by Microsoft for affected versions such as Windows 7, Windows 10, and all relevant Windows Server editions. Regularly review and apply security updates to keep your systems secure! You've got this! Stay vigilant and follow these steps to keep your systems locked down! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.04196 · 90.9th percentile
Published
2018-12-12T00:00Z
KEV added
2022-05-24 · due 2022-06-14
EPSS history
Timeline
  • 24 MAY 00:00Z
    Added to CISA KEV — remediate by Jun 14
    kev
  • 12 DEC 00:00Z
    An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "Windows Kernel Elevation of Privilege…
    cvelistv5