PT-2018-2093 · Microsoft · Windows Server 2016+10

Symeon Paraschoudis · Published 2018-10-09 · Updated 2026-02-07 · CVE-2018-8472

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Windows 7 Windows Server 2008 Windows Server 2008 R2 Windows Server 2012 Windows Server 2012 R2 Windows Server 2016 Windows Server 2019 Windows 8.1 Windows RT 8.1 Windows 10 Windows 10 Servers

Description An information disclosure issue exists in the way the Windows Graphics Device Interface (GDI) handles objects in memory. This allows an attacker to retrieve information from a targeted system. The vulnerability can be exploited by using a specially crafted application to disclose protected information.

Recommendations For Windows 7, update to a newer version to mitigate the risk. For Windows Server 2008, update to a newer version to mitigate the risk. For Windows Server 2008 R2, update to a newer version to mitigate the risk. For Windows Server 2012, update to a newer version to mitigate the risk. For Windows Server 2012 R2, update to a newer version to mitigate the risk. For Windows Server 2016, update to a newer version to mitigate the risk. For Windows Server 2019, update to a newer version to mitigate the risk. For Windows 8.1, update to a newer version to mitigate the risk. For Windows RT 8.1, update to a newer version to mitigate the risk. For Windows 10, update to a newer version to mitigate the risk. For Windows 10 Servers, update to a newer version to mitigate the risk.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2019-00044

CVE-2018-8472

Affected Products

Windows

Windows 10

Windows 7

Windows 8.1

Windows Rt 8.1

Windows Server 2008

Windows Server 2008 R2

Windows Server 2012

Windows Server 2012 R2

Windows Server 2016

Windows Server 2019

References · 8

• https://osv.dev/vulnerability/CVE-2018-8472 · Vendor Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8472 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00044 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-8472 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8472 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2018-8472 · Vendor Advisory
• http://securityfocus.com/bid/105488 · Note
• http://securitytracker.com/id/1041823 · Note