---
id: "CVE-2018-8406"
kind: "vulnerability"
aliases: ["CVE-2018-8406"]
title: "Microsoft DirectX Graphics Kernel (DXGKRNL): Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability"
severity: "high"
cvss: 7.8
epss: 0.03444
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Microsoft DirectX Graphics Kernel (DXGKRNL)", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "ransomware", "self-hosted", "windows"]
not_affected_if: ["fully-patched-windows"]
published_at: "2018-08-15T17:29:10+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-8406", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2018-8406", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8406", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Microsoft DirectX Graphics Kernel (DXGKRNL): Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability

A flaw in the Windows DirectX Graphics Kernel driver lets a local user mishandle objects in memory and gain higher privileges. It is on CISA's known-exploited list and is tagged as used in ransomware campaigns.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft DirectX Graphics Kernel (DXGKRNL) affected ? fixed ?

## How to check

Check the installed Windows build and whether the Microsoft update for CVE-2018-8406 is applied; the sources do not give a command.

## Fix

Apply the Microsoft security update for CVE-2018-8406 per vendor instructions (CISA required action). Specific patched build numbers: unknown.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-8406
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2018-8406
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2018-8406

## From the sources

An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Kernel Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8400, CVE-2018-8401, CVE-2018-8405.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_