7.8 High Exploited · ransomware

CVE-2018-8453 Microsoft Win32k Privilege Escalation Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply updates per vendor instructions.

Ransomware campaigns Known to be used

Weakness CWE-404

Description

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

Affected products and versions

Product	Affected versions	Fixed in
Windows 7	Versions not published
Windows Server 2012 R2	Versions not published
Windows RT 8.1	Versions not published
Windows Server 2008	Versions not published
Windows Server 2019	Versions not published
Windows Server 2012	Versions not published
Windows 8.1	Versions not published
Windows Server 2016	Versions not published
Windows Server 2008 R2	Versions not published

Show the 2 other branches

Product	Affected versions	Fixed in
Windows 10	Versions not published
Windows 10 Servers	Versions not published

References

1041828 www.securitytracker.com
securelist.com securelist.com
portal.msrc.microsoft.com portal.msrc.microsoft.com
105467 www.securityfocus.com
packetstormsecurity.com packetstormsecurity.com

Timeline

Published October 10, 2018
Added to the KEV catalogue January 21, 2022
Last modified August 13, 2026

The 947 CVEs of Windows 7 →

CVE-2022-35759 Windows Local Security Authority (LSA) Denial of Service Vulnerability 6.5 Medium CVE-2022-35758 Windows Kernel Memory Information Disclosure Vulnerability 5.5 Medium CVE-2022-35756 Windows Kerberos Elevation of Privilege Vulnerability 7.8 High CVE-2022-35752 Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability 8.1 High

Track this CVE