CVE-2018-0966

LOW

Windows 10 and Windows Server 2016 - Device Guard Security Feature Bypass via TOCTOU Race Condition

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2018-0966. PoCs published by Google Security Research.

AI-analyzed exploit summary This exploit leverages a TOCTOU (Time-of-Check to Time-of-Use) vulnerability in Windows 10 1709 to bypass Device Guard policies by manipulating file handles and cached signing levels. The PoC demonstrates how an unsigned executable can be falsely signed by exploiting insufficient access checks in the CiSetFileCache function.

Description

A security feature bypass exists when Device Guard incorrectly validates an untrusted file, aka "Device Guard Security Feature Bypass Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Google Security Research · textdoswindows
https://www.exploit-db.com/exploits/44466

This exploit leverages a TOCTOU (Time-of-Check to Time-of-Use) vulnerability in Windows 10 1709 to bypass Device Guard policies by manipulating file handles and cached signing levels. The PoC demonstrates how an unsigned executable can be falsely signed by exploiting insufficient access checks in the CiSetFileCache function.

Classification
Working Poc 90%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Racy
Target: Windows 10 1709 (including Win10S)
No auth needed
Prerequisites: Access to a Windows 10 1709 system · NTFS volume with USN Change Journal enabled · Unsigned executable to be 'cache signed'
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1040660
Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/44466/
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/103622

Scores

CVSS v3 3.3
EPSS 0.0236
EPSS Percentile 81.6%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Details

CWE
CWE-367
Status published
Products (7)
microsoft/windows_10
microsoft/windows_10 1511
microsoft/windows_10 1607
microsoft/windows_10 1703
microsoft/windows_10 1709
microsoft/windows_server_2016
microsoft/windows_server_2016 1709
Published Apr 12, 2018
Tracked Since Feb 18, 2026