PT-2018-2030 · Microsoft · Windows Server 2016+11

Bear13Oy · Published 2018-12-11 · Updated 2026-01-30 · CVE-2018-8639

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2019 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers

Description An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. This issue can be exploited by attackers to obtain sensitive information and affect the system. The vulnerability is caused by the Win32k component's improper handling of buffer boundaries in memory, which can allow an attacker to execute arbitrary code in kernel mode using a specially crafted application.

Recommendations For Windows 7, update to a newer version to mitigate the risk. For Windows Server 2012 R2, update to a newer version to mitigate the risk. For Windows RT 8.1, update to a newer version to mitigate the risk. For Windows Server 2008, update to a newer version to mitigate the risk. For Windows Server 2019, update to a newer version to mitigate the risk. For Windows Server 2012, update to a newer version to mitigate the risk. For Windows 8.1, update to a newer version to mitigate the risk. For Windows Server 2016, update to a newer version to mitigate the risk. For Windows Server 2008 R2, update to a newer version to mitigate the risk. For Windows 10, update to a newer version to mitigate the risk. For Windows 10 Servers, update to a newer version to mitigate the risk. As a temporary workaround, consider disabling the Win32k component until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation. Avoid using specially crafted applications that can exploit the vulnerability in the Win32k component.

Exploit

Fix

LPE

Buffer Overflow

Improper Resource Release

Improper Privilege Management

Weakness Enumeration

CWE-119

CWE-404

CWE-269

Related Identifiers

BDU:2018-01646

CVE-2018-8639

Affected Products

Windows

Windows 10

Windows 10 Servers

Windows 7

Windows 8.1

Windows Rt 8.1

Windows Server 2008

Windows Server 2008 R2

Windows Server 2012

Windows Server 2012 R2

Windows Server 2016

Windows Server 2019

References · 30

• 🔥 https://github.com/ze0r/CVE-2018-8639-exp · Exploit
• 🔥 https://github.com/timwhitez/CVE-2018-8639-EXP · Exploit
• https://osv.dev/vulnerability/CVE-2018-8639 · Vendor Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8639 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-01646 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8639 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2018-8639 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-8639 · Security Note
• https://t.me/cvenotify/124944 · Telegram Post
• https://reddit.com/r/pwnhub/comments/1j2rbqo/cisa_warns_of_newly_exploited_vulnerabilities · Reddit Post
• https://t.me/cveNotify/140809 · Telegram Post
• https://twitter.com/TweetThreatNews/status/1896899544744374715 · Twitter Post
• https://vuldb.com/?id.127828 · Note
• https://twitter.com/Cyber_Sec_Raj/status/1897487808727486692 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1j3wj7i/cisa_warns_critical_flaws_in_cisco_hitachi · Reddit Post