{"id":"CVE-2018-8405","kind":"vulnerability","aliases":["CVE-2018-8405"],"related":[],"title":"Microsoft DirectX Graphics Kernel (DXGKRNL): Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability","description":"An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka \"DirectX Graphics Kernel Elevation of Privilege Vulnerability.\" This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2016, Windows 8.1, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8400, CVE-2018-8401, CVE-2018-8406.","summary":"A flaw in the Windows DirectX Graphics Kernel driver lets a local user mishandle objects in memory and gain higher privileges. An attacker who already has a foothold on the machine can become SYSTEM.","severity":"high","cvss":7.8,"epss":0.03444,"exploited":true,"exploited_at":"2022-03-28T00:00:00+00:00","products":[{"name":"Microsoft DirectX Graphics Kernel (DXGKRNL)","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","microsoft-dxgkrnl","ransomware","windows"],"not_affected_if":["patched-windows"],"how_to_check":null,"fix":"Apply the Microsoft security update for CVE-2018-8405 per vendor instructions (CISA required action).","status":"open","published_at":"2018-08-15T17:29:10+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:19:47+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T21:19:47Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft security update for CVE-2018-8405 per vendor instructions (CISA required action).","reach":"local","impact":"high","summary":"A flaw in the Windows DirectX Graphics Kernel driver lets a local user mishandle objects in memory and gain higher privileges. An attacker who already has a foothold on the machine can become SYSTEM.","category":"infrastructure","who_cares":["windows","microsoft-dxgkrnl"],"confidence":0.7,"needs_auth":"yes","worst_case":"local user gains SYSTEM privileges on the Windows machine","analyst_note":"Find the affected Windows builds and the Microsoft patch KB for CVE-2018-8405 in the MSRC advisory; sources do not list versions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["patched-windows"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000457,"input_tokens":2878,"output_tokens":338,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2018':14A,17A,117C,120C,123C '-8400':118C '-8401':121C '-8405':15A,18A '-8406':124C '10':106C,108C '2012':95C '2016':102C '8.1':99C,104C 'affect':92C 'aka':83C 'alreadi':55B 'attack':53B 'becom':63B 'cve':13A,16A,111C,116C,119C,122C 'directx':2A,7A,20A,36B,73C,84C 'driver':39B,77C 'dxgkrnl':5A,23A,28B,76C 'elev':66C,87C 'escal':11A 'exist':70C 'exploit':24B 'flaw':32B 'foothold':58B 'gain':49B 'graphic':3A,8A,37B,74C,85C 'graphics':21A 'handl':79C 'higher':50B 'id':112C 'improp':78C 'infrastructur':25B 'kernel':4A,9A,22A,38B,75C,86C 'let':40B 'local':42B 'machin':61B 'memori':47B,82C 'microsoft':1A,6A,19A,27B 'microsoft-dxgkrnl':26B 'mishandl':44B 'object':45B,80C 'privileg':10A,51B,68C,89C 'r2':96C 'ransomwar':29B 'rt':98C 'server':94C,101C,109C 'system':64B 'uniqu':114C 'user':43B 'vulner':12A,69C,90C 'window':30B,35B,93C,97C,100C,103C,105C,107C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2018-08-15T17:29:10+00:00","kev":{"dateAdded":"2022-03-28","dueDate":"2022-04-18","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2018-8405","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-8405","severity":null,"published_at":"2022-03-28T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T14:39:40+00:00","note":null},{"source":"epss","external_id":"CVE-2018-8405","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-8405","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2018-8405","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-8405","severity":null,"published_at":"2018-08-15T17:29:10+00:00","modified_at":"2026-06-17T02:04:47+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}