Actively exploited in the wild
Microsoft Win32k Privilege Escalation Vulnerability
Microsoft - Win32k · Listed in the CISA KEV since 2022-05-23. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2018-8589
HighCVSS 7.8KEVSummary
An elevation of privilege vulnerability exists when Windows improperly handles calls to Win32k.sys. This affects Windows Server 2008, Windows 7, and Windows Server 2008 R2.
Risk Assessment
An attacker could exploit this vulnerability to elevate privileges on the system, potentially leading to full system compromise. However, prior access to the system is required.
Recommendation
Apply the security updates provided by Microsoft for the affected Windows versions. Regularly update systems and monitor for unusual activities.
Other vulnerabilities in Microsoft Windows Win32k
Original NVD description (English source)
An elevation of privilege vulnerability exists when Windows improperly handles calls to Win32k.sys, aka "Windows Win32k Elevation of Privilege Vulnerability." This affects Windows Server 2008, Windows 7, Windows Server 2008 R2.