IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
7.0Alta KEV Usada en ransomware

CVE-2018-8120Microsoft Win32k Privilege Escalation Vulnerability

Microsoft Windows Server 2008; Microsoft Windows 7; Microsoft Windows Server 2008 R2 Publicada: (hace 8 años)

Explotación conocida — Microsoft Win32k Privilege Escalation Vulnerability

CISA confirmó el 15.03.2022 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 05.04.2022.

Acción requerida: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2018-8120

Descripción

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows Server 2008, Windows 7, Windows Server 2008 R2. This CVE ID is unique from CVE-2018-8124, CVE-2018-8164, CVE-2018-8166.

Debilidad (CWE): CWE-404

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
Microsoft Windows 7 32-bit Systems Service Pack 1, x64-based Systems Service Pack 1
Microsoft Windows Server 2008 32-bit Systems Service Pack 2, 32-bit Systems Service Pack 2 (Server Core installation), Itanium-Based Systems Service Pack 2, x64-based Systems Service Pack 2, x64-based Systems Service Pack 2 (Server Core installation)
Microsoft Windows Server 2008 R2 Itanium-Based Systems Service Pack 1, x64-based Systems Service Pack 1, x64-based Systems Service Pack 1 (Server Core installation)

Referencias y parches

Coincidencias CPE (NVD) (4)
  • cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*
  • cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*

CVE recientes del mismo producto — Windows Server

9.8Crítica
CVE-2026-105016

Microsoft QUIC Remote Code Execution Vulnerability

Microsoft .NET 10.0 runtime; Microsoft .NET 11.0 runtime; Microsoft .NET 8.0 runtime; Microsoft .NET 9.0 runtime

Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

1.7%EPSS
6.5Media
CVE-2026-108129

Role: DNS Server Information Disclosure Vulnerability

Microsoft Windows 10 Version 1607; Microsoft Windows 10 Version 1809; Microsoft Windows 10 Version 21H2; Microsoft Windows 10 Version 22H2

Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.

1.1%EPSS