Actively exploited in the wild

Microsoft Win32k Privilege Escalation Vulnerability

Microsoft - Win32k · Listed in the CISA KEV since 2022-03-15. This indicates confirmed attacks in production environments.

Required action: Apply updates per vendor instructions.

CVE-2018-8120

HighCVSS 7.0KEV

Published: 09/05/2018(UTC)Updated: 13/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

73.72%

99th percentile - higher than 99% of all known CVEs

Summary

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability.' This affects Windows Server 2008, Windows 7, Windows Server 2008 R2. This CVE ID is unique from CVE-2018-8124, CVE-2018-8164, CVE-2018-8166.

Risk Assessment

A local attacker can exploit this vulnerability to elevate privileges and gain full control over the system.

Recommendation

Install available security updates from Microsoft for affected Windows systems.

Original NVD description (English source)

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows Server 2008, Windows 7, Windows Server 2008 R2. This CVE ID is unique from CVE-2018-8124, CVE-2018-8164, CVE-2018-8166.