IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
8.4Yüksek KEV Fidye yazılımında kullanılıyor

CVE-2018-8639Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability

Microsoft Windows 7; Microsoft Windows Server 2012 R2; Microsoft Windows RT 8.1; Microsoft Windows Server 2008 Yayım: (7 yıl önce)

Aktif olarak istismar ediliyor — Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability

CISA bu açığın gerçek saldırılarda kullanıldığını 03.03.2025 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 24.03.2025.

Gerekli işlem: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2018-8639 ; https://nvd.nist.gov/vuln/detail/CVE-2018-8639

Açıklama

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8641.

Zayıflık türü (CWE): CWE-404

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
Microsoft Windows 10 32-bit Systems, Version 1607 for 32-bit Systems, Version 1607 for x64-based Systems, Version 1703 for 32-bit Systems, Version 1703 for x64-based Systems, Version 1709 for 32-bit Systems, Version 1709 for ARM64-based Systems, Version 1709 for x64-based Systems, Version 1803 for 32-bit Systems, Version 1803 for ARM64-based Systems, Version 1803 for x64-based Systems, Version 1809 for 32-bit Systems, Version 1809 for ARM64-based Systems, Version 1809 for x64-based Systems, x64-based Systems
microsoft windows 10 1507 —
microsoft windows 10 1607 —
microsoft windows 10 1703 —
microsoft windows 10 1709 —
microsoft windows 10 1803 —
microsoft windows 10 1809 —
Microsoft Windows 10 Servers version 1709 (Server Core Installation), version 1803 (Server Core Installation)
Microsoft Windows 7 32-bit Systems Service Pack 1, x64-based Systems Service Pack 1
Microsoft Windows 8.1 32-bit systems, x64-based systems
Microsoft Windows RT 8.1 Windows RT 8.1
Microsoft Windows Server 2008 32-bit Systems Service Pack 2, 32-bit Systems Service Pack 2 (Server Core installation), Itanium-Based Systems Service Pack 2, x64-based Systems Service Pack 2, x64-based Systems Service Pack 2 (Server Core installation)
Microsoft Windows Server 2008 R2 Itanium-Based Systems Service Pack 1, x64-based Systems Service Pack 1, x64-based Systems Service Pack 1 (Server Core installation)
Microsoft Windows Server 2012 (Server Core installation)
Microsoft Windows Server 2012 R2 (Server Core installation)
Microsoft Windows Server 2016 (Server Core installation)
Microsoft Windows Server 2019 (Server Core installation)

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (17)
  • cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:pro_n:*:*:*
  • cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:itanium:*
  • cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:x64:*
  • cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*

Aynı üründe son açıklar — Windows 10

7.0Yüksek
CVE-2026-108135

Windows Backup Engine Elevation of Privilege Vulnerability

Microsoft Windows 10 Version 21H2; Microsoft Windows 10 Version 22H2; Microsoft Windows 11 version 23H2; Microsoft Windows 11 Version 23H2

Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.

6.5Orta
CVE-2026-108129

Role: DNS Server Information Disclosure Vulnerability

Microsoft Windows 10 Version 1607; Microsoft Windows 10 Version 1809; Microsoft Windows 10 Version 21H2; Microsoft Windows 10 Version 22H2

Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.

1.1%EPSS