---
id: "CVE-2018-8589"
kind: "vulnerability"
aliases: ["CVE-2018-8589"]
title: "Microsoft Win32k: Microsoft Win32k Privilege Escalation Vulnerability"
severity: "high"
cvss: 7.8
epss: 0.03023
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Microsoft Win32k", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "self-hosted", "windows"]
not_affected_if: ["patched-windows"]
published_at: "2018-11-14T01:29:02+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-8589", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2018-8589", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8589", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Microsoft Win32k: Microsoft Win32k Privilege Escalation Vulnerability

A flaw in Windows Win32k.sys mishandles calls, letting a local user escalate privileges. An attacker who exploits it runs code as the local SYSTEM account.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Win32k affected ? fixed ?

## Fix

Apply the Microsoft update for CVE-2018-8589 per vendor instructions (CISA KEV required action).

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-8589
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2018-8589
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2018-8589

## From the sources

A privilege escalation vulnerability exists when Windows improperly handles calls to Win32k.sys. An attacker who successfully exploited this vulnerability could run remote code in the security context of the local system.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_