PT-2018-2287 · Microsoft · Windows 7+3

2Igosha + 3 · Published 2018-11-13 · Updated 2025-04-04 · CVE-2018-8589

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows Server 2008 Windows 7 Windows Server 2008 R2

Description The issue is caused by a buffer overflow in the memory of the Win32k component (Win32k.sys) in Windows operating systems. This can allow an attacker to execute arbitrary code using a specially crafted application. The vulnerability exists due to Windows improperly handling calls to Win32k.sys, which can lead to an elevation of privilege.

Recommendations For Windows Server 2008, Windows 7, and Windows Server 2008 R2, apply the necessary patches or updates to fix the Win32k.sys component. As a temporary workaround, consider restricting access to the Win32k.sys component until a patch is available. Avoid using the affected Windows systems for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-264

Related Identifiers

BDU:2019-00411

CVE-2018-8589

Affected Products

Windows

Windows 7

Windows Server 2008

Windows Server 2008 R2

References · 13

• 🔥 https://securelist.com/a-new-exploit-for-zero-day-vulnerability-cve-2018-8589/88845 · Exploit
• https://bdu.fstec.ru/vul/2019-00411 · Security Note
• https://osv.dev/vulnerability/CVE-2018-8589 · Vendor Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8589 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-8589 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2018-8589 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8589 · Security Note
• http://securitytracker.com/id/1042140 · Note
• http://securityfocus.com/bid/105796 · Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8589 · Note
• https://xakep.ru/2018/11/14/november-patches · Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog · Note
• https://t.me/cvenotify/117790 · Telegram Post