{"id":"CVE-2018-8120","kind":"vulnerability","aliases":["CVE-2018-8120"],"related":[],"title":"Microsoft Win32k: Microsoft Win32k Privilege Escalation Vulnerability","description":"An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka \"Win32k Elevation of Privilege Vulnerability.\" This affects Windows Server 2008, Windows 7, Windows Server 2008 R2. This CVE ID is unique from CVE-2018-8124, CVE-2018-8164, CVE-2018-8166.","summary":"Microsoft Windows Win32k kernel component mishandles objects in memory, allowing local privilege escalation. An attacker with code running on the machine can gain SYSTEM-level control.","severity":"high","cvss":7.2,"epss":0.73288,"exploited":true,"exploited_at":"2022-03-15T00:00:00+00:00","products":[{"name":"Microsoft Win32k","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","ransomware","self-hosted","windows"],"not_affected_if":["patched-systems"],"how_to_check":null,"fix":"Apply the Microsoft security update for CVE-2018-8120 per vendor instructions (CISA KEV required action).","status":"open","published_at":"2018-05-09T19:29:01+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:22:14+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:22:14Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft security update for CVE-2018-8120 per vendor instructions (CISA KEV required action).","reach":"local","impact":"high","summary":"Microsoft Windows Win32k kernel component mishandles objects in memory, allowing local privilege escalation. An attacker with code running on the machine can gain SYSTEM-level control.","category":"infrastructure","who_cares":["windows","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Local attacker gains SYSTEM privileges on the Windows machine","analyst_note":"Exploited in the wild per CISA KEV and ransomware-tagged; confirm affected Windows builds and the patch KB at Microsoft's CVE-2018-8120 advisory.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["patched-systems"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000453,"input_tokens":2824,"output_tokens":342,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2018':9A,12A,93C,96C,99C '-8120':10A,13A '-8124':94C '-8164':97C '-8166':100C '2008':79C,84C '7':81C 'affect':76C 'aka':69C 'allow':32B 'attack':37B 'code':39B 'compon':27B,61C 'control':49B 'cve':8A,11A,87C,92C,95C,98C 'elev':51C,71C 'escal':6A,35B 'exist':55C 'exploit':16B 'fail':62C 'gain':45B 'handl':65C 'host':21B 'id':88C 'infrastructur':17B 'kernel':26B 'level':48B 'local':33B 'machin':43B 'memori':31B,68C 'microsoft':1A,3A,14A,23B 'mishandl':28B 'object':29B,66C 'privileg':5A,34B,53C,73C 'proper':64C 'r2':85C 'ransomwar':18B 'run':40B 'self':20B 'self-host':19B 'server':78C,83C 'system':47B 'system-level':46B 'uniqu':90C 'vulner':7A,54C,74C 'win32k':2A,4A,15A,25B,60C,70C 'window':22B,24B,57C,77C,80C,82C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2018-05-09T19:29:01+00:00","kev":{"dateAdded":"2022-03-15","dueDate":"2022-04-05","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2018-8120","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-8120","severity":null,"published_at":"2022-03-15T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T10:39:07+00:00","note":null},{"source":"epss","external_id":"CVE-2018-8120","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-8120","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2018-8120","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-8120","severity":null,"published_at":"2018-05-09T19:29:01+00:00","modified_at":"2026-08-13T05:17:18+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}