CVE-2018-8589
High 7.8 Exploited in the wild (KEV)
Confirmed active exploitation — CISA KEV catalog
- Name
- Microsoft Win32k Privilege Escalation Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
An elevation of privilege vulnerability exists when Windows improperly handles calls to Win32k.sys, aka "Windows Win32k Elevation of Privilege Vulnerability." This affects Windows Server 2008, Windows 7, Windows Server 2008 R2.
Metrics
- CVSS 3.1
-
7.8 (HIGH)
Score source: NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 3% (percentile: 87) as of 1 November 2026
Affected products
microsoft: windows 7; microsoft: windows server 2008
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8589 PatchVendor Advisory
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8589 PatchVendor Advisory
- http://www.securityfocus.com/bid/105796 Broken LinkThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1042140 Broken LinkThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/105796 Broken LinkThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1042140 Broken LinkThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018… US Government Resource