CVE-2018-8637

MEDIUM EXPLOITED IN THE WILD

Windows 10 and Windows Server 2016/2019 - Kernel Information Disclosure

Title source: llm

Exploitation Summary

CVE-2018-8637 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io).

Description

An information disclosure vulnerability exists in Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address Space Layout Randomization (KASLR) bypass, aka "Win32k Information Disclosure Vulnerability." This affects Windows 10 Servers, Windows 10, Windows Server 2019.

References (2)

Core 2

Core References

Patch, Vendor Advisory x_refsource_confirm

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8637

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/106095

Scores

CVSS v3 5.5

EPSS 0.0185

EPSS Percentile 77.0%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

VulnCheck KEV 2021-01-21

InTheWild.io 2019-01-02

Status published

Products (4)

microsoft/windows_10 1803

microsoft/windows_10 1809

microsoft/windows_server_2016 1803

microsoft/windows_server_2019

Published Dec 12, 2018

Tracked Since Feb 18, 2026