{"id":"CVE-2018-8406","kind":"vulnerability","aliases":["CVE-2018-8406"],"related":[],"title":"Microsoft DirectX Graphics Kernel (DXGKRNL): Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability","description":"An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka \"DirectX Graphics Kernel Elevation of Privilege Vulnerability.\" This affects Windows Server 2016, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8400, CVE-2018-8401, CVE-2018-8405.","summary":"A flaw in the Windows DirectX Graphics Kernel driver lets a local user mishandle objects in memory and gain higher privileges. It is on CISA's known-exploited list and is tagged as used in ransomware campaigns.","severity":"high","cvss":7.8,"epss":0.03444,"exploited":true,"exploited_at":"2022-03-28T00:00:00+00:00","products":[{"name":"Microsoft DirectX Graphics Kernel (DXGKRNL)","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","ransomware","self-hosted","windows"],"not_affected_if":["fully-patched-windows"],"how_to_check":"Check the installed Windows build and whether the Microsoft update for CVE-2018-8406 is applied; the sources do not give a command.","fix":"Apply the Microsoft security update for CVE-2018-8406 per vendor instructions (CISA required action). Specific patched build numbers: unknown.","status":"open","published_at":"2018-08-15T17:29:10+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:19:45+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T21:19:45Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft security update for CVE-2018-8406 per vendor instructions (CISA required action). Specific patched build numbers: unknown.","reach":"local","impact":"high","summary":"A flaw in the Windows DirectX Graphics Kernel driver lets a local user mishandle objects in memory and gain higher privileges. It is on CISA's known-exploited list and is tagged as used in ransomware campaigns.","category":"infrastructure","who_cares":["windows","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"local user gains SYSTEM privileges on the Windows machine","analyst_note":"Find the Microsoft advisory for CVE-2018-8406 to get affected and fixed Windows builds and the exact update KB numbers; the sources give none.","how_to_check":"Check the installed Windows build and whether the Microsoft update for CVE-2018-8406 is applied; the sources do not give a command.","needs_analyst":true,"not_affected_if":["fully-patched-windows"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000486,"input_tokens":2878,"output_tokens":396,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2018':14A,17A,112C,115C,118C '-8400':113C '-8401':116C '-8405':119C '-8406':15A,18A '10':101C,103C '2016':99C 'affect':96C 'aka':87C 'campaign':68B 'cisa':55B 'cve':13A,16A,106C,111C,114C,117C 'directx':2A,7A,20A,36B,77C,88C 'driver':39B,81C 'dxgkrnl':5A,23A,80C 'elev':70C,91C 'escal':11A 'exist':74C 'exploit':24B,59B 'flaw':32B 'gain':49B 'graphic':3A,8A,37B,78C,89C 'graphics':21A 'handl':83C 'higher':50B 'host':29B 'id':107C 'improp':82C 'infrastructur':25B 'kernel':4A,9A,22A,38B,79C,90C 'known':58B 'known-exploit':57B 'let':40B 'list':60B 'local':42B 'memori':47B,86C 'microsoft':1A,6A,19A 'mishandl':44B 'object':45B,84C 'privileg':10A,51B,72C,93C 'ransomwar':26B,67B 'self':28B 'self-host':27B 'server':98C,104C 'tag':63B 'uniqu':109C 'use':65B 'user':43B 'vulner':12A,73C,94C 'window':30B,35B,97C,100C,102C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2018-08-15T17:29:10+00:00","kev":{"dateAdded":"2022-03-28","dueDate":"2022-04-18","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2018-8406","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-8406","severity":null,"published_at":"2022-03-28T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T11:39:16+00:00","note":null},{"source":"epss","external_id":"CVE-2018-8406","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-8406","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2018-8406","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-8406","severity":null,"published_at":"2018-08-15T17:29:10+00:00","modified_at":"2026-06-17T02:04:47+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}