CVE-2018-8449

LOW

Windows 10 and Windows Server 2016 - Security Feature Bypass via Device Guard File Validation

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2018-8449. PoCs published by Google Security Research.

AI-analyzed exploit summary This exploit leverages a TOCTOU (Time-of-Check Time-of-Use) race condition in the Windows Cache Manager to bypass WDAC (Windows Defender Application Control) by manipulating file cache signing levels via NtCreateSection. It involves an oplock-based race to replace a signed file with an unsigned one while the cache is being set.

Description

A security feature bypass exists when Device Guard incorrectly validates an untrusted file, aka "Device Guard Security Feature Bypass Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Google Security Research · textdoswindows
https://www.exploit-db.com/exploits/45435

This exploit leverages a TOCTOU (Time-of-Check Time-of-Use) race condition in the Windows Cache Manager to bypass WDAC (Windows Defender Application Control) by manipulating file cache signing levels via NtCreateSection. It involves an oplock-based race to replace a signed file with an unsigned one while the cache is being set.

Classification
Working Poc 90%
Attack Type
Other
Complexity
Complex
Reliability
Racy
Target: Windows 10 1803, 1709
No auth needed
Prerequisites: Access to a writable NTFS volume with USN Change Journal enabled · A signed executable to use as a template · Process with elevated section signing level (e.g., via SetProcessMitigationPolicy or WDAC/CIG process)
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1041642
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/105272
Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/45435/

Scores

CVSS v3 3.3
EPSS 0.0311
EPSS Percentile 86.1%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Details

CWE
CWE-367
Status published
Products (8)
microsoft/windows_10
microsoft/windows_10 1607
microsoft/windows_10 1703
microsoft/windows_10 1709
microsoft/windows_10 1803
microsoft/windows_server_2016
microsoft/windows_server_2016 1709
microsoft/windows_server_2016 1803
Published Sep 13, 2018
Tracked Since Feb 18, 2026