{"id":"CVE-2018-8120","published":"2018-05-09T19:29:01Z","modified":"2026-08-13T05:17:18Z","title":"Microsoft Win32k Privilege Escalation Vulnerability","vendor":"Microsoft","product":"Win32k","tier":"core","eol":null,"description":{"text":"An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka \"Win32k Elevation of Privilege Vulnerability.\" This affects Windows Server 2008, Windows 7, Windows Server 2008 R2. This CVE ID is unique from CVE-2018-8124, CVE-2018-8164, CVE-2018-8166.","provenance":"source","from":"NVD"},"summary":{"text":"A flaw in the Win32k component of Microsoft Windows, where the component fails to properly handle objects in memory, enables an elevation of privilege vulnerability affecting Windows Server 2008, Windows 7, and Windows Server 2008 R2. An attacker with local access and low-privilege credentials, who must overcome a high-complexity condition, could elevate their privileges, without requiring any user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:00:04Z"},"cvss":{"score":7.0,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.73288,"percentile":0.99458,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-03-15","dueDate":"2022-04-05","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-8120","provenance":"source"},"vulncheckKev":{"dateAdded":"2018-05-08","exploitedFirstSeen":"2018-05-08","ransomware":true,"evidence":[{"url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2018-May","date":"2018-05-08"},{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2018-05-08"},{"url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/rapidly-evolving-ransomware-gandcrab-version-5-partners-with-crypter-service-for-obfuscation/","date":"2018-10-10"},{"url":"https://securelist.com/scarcruft-continues-to-evolve-introduces-bluetooth-harvester/90729/","date":"2019-05-13"},{"url":"https://web.archive.org/web/20220227045141/https://risksense.com/wp-content/uploads/2019/09/RiskSense-Spotlight-Report-Ransomware.pdf","date":"2019-09-01"},{"url":"https://www.trendmicro.com/en_us/research/19/i/purple-fox-fileless-malware-with-rookit-component-delivered-by-rig-exploit-kit-now-abuses-powershell.html","date":"2019-09-09"},{"url":"https://services.google.com/fh/files/misc/rpt-mtrends-2021-en.pdf","date":"2021-04-13"},{"url":"https://threatresearch.ext.hp.com/purple-fox-exploit-kit-now-exploits-cve-2021-26411/","date":"2021-04-14"},{"url":"https://decoded.avast.io/martinchlumecky/dirtymoe-1/","date":"2021-06-16"},{"url":"https://dl.acm.org/doi/pdf/10.1145/3465481.3465758","date":"2021-08-17"}],"evidenceTotal":17,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-404","name":"Improper Resource Shutdown or Release"}],"references":[{"url":"http://www.securityfocus.com/bid/104034","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1040849","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8120","tags":["Patch","Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/45653/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/104034","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1040849","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8120","tags":["Patch","Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/45653/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8120","tags":["US Government Resource"]}],"techniques":[{"id":"T1189","name":"Drive-by Compromise","tactics":["initial-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: local privilege escalation via kernel component flaw","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"An elevation of privilege vulnerability exists in Windows when the Win32k component","start":0,"end":83}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2018-19796","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-19796","exploited":true,"exploitedSince":"2022-03-15","provenance":"source"},"exploits":[{"id":45653,"url":"https://www.exploit-db.com/exploits/45653","title":"Microsoft Windows - SetImeInfoEx Win32k NULL Pointer Dereference (Metasploit)","type":"local","platform":"windows","date":"2018-10-22","verified":true,"provenance":"source"},{"id":45653,"url":"https://www.exploit-db.com/exploits/45653","title":"Microsoft Windows - SetImeInfoEx Win32k NULL Pointer Dereference (Metasploit)","type":"local","platform":"windows","date":"2018-10-22","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2018-10-22"},"pocGithub":{"count":7,"skipped":3,"earliest":"2018-05-17","earliestUrl":"https://github.com/bigric3/cve-2018-8120","repos":[{"name":"rip1s/CVE-2018-8120","url":"https://github.com/rip1s/CVE-2018-8120","stars":497,"created":"2018-05-19"},{"name":"alpha1ab/CVE-2018-8120","url":"https://github.com/alpha1ab/CVE-2018-8120","stars":295,"created":"2018-06-07"},{"name":"bigric3/cve-2018-8120","url":"https://github.com/bigric3/cve-2018-8120","stars":164,"created":"2018-05-17"},{"name":"ne1llee/cve-2018-8120","url":"https://github.com/ne1llee/cve-2018-8120","stars":5,"created":"2018-06-05"},{"name":"EVOL4/CVE-2018-8120","url":"https://github.com/EVOL4/CVE-2018-8120","stars":1,"created":"2018-07-11"}]},"metasploit":[{"name":"Windows SetImeInfoEx Win32k NULL Pointer Dereference","module":"exploit/windows/local/ms18_8120_win32k_privesc","type":"exploit","disclosureDate":"2018-05-09","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/ms18_8120_win32k_privesc.rb"}],"first":{"date":"2018-05-09","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/ms18_8120_win32k_privesc.rb"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/45653/"],"flow":[{"stage":"exploitation","techniques":["T1068"],"provenance":"ai"},{"stage":"related","techniques":["T1189","T1203"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2018-05-08","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2018-May","provenance":"source"},{"date":"2018-05-09","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-8120","provenance":"source"},{"date":"2018-05-09","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2018-05-17, Exploit-DB 2018-10-22","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/ms18_8120_win32k_privesc.rb","provenance":"source"},{"date":"2022-03-15","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-15","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-19796","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":1406},"priority":{"score":77.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 3096 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.89,"detail":"percentile 0.9946"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 2 Exploit-DB entries; 7 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":4.9,"detail":"base score 7.0"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}