CVE-2018-8120

KEVRansomware UseMicrosoft Win32k Privilege Escalation Vulnerability

Description

A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory.

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows Server 2008, Windows 7, Windows Server 2008 R2. This CVE ID is unique from CVE-2018-8124, CVE-2018-8164, CVE-2018-8166.

CVSS 3.1 vectorCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

PublishedMay 9, 2018

Last modifiedAug 13, 2026

Added to KEVMar 15, 2022

Remediation dueApr 5, 2022

References

securityfocus.com/bid/104034Broken LinkThird Party Advisory
securitytracker.com/id/1040849Broken LinkThird Party Advisory
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8120PatchVendor Advisory
exploit-db.com/exploits/45653/ExploitThird Party Advisory
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8120US Government Resource

0 recent articles mention this CVE

Risk assessment · Critical

Actively exploited and used by ransomware crews. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1666 days
Ransomware: Used in known ransomware campaigns
CVSS: 7.0 HIGH
EPSS (30-day exploit probability): 73.3% · top 1% of all CVEs
Weakness: CWE-404

Recommended actions

1.Apply updates per vendor instructions.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
4.Verify offline/immutable backups and segment the affected systems. This flaw is used for ransomware initial access.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.