Risk Letters

Exploited vulnerability

CVE-2018-8639

TLP:CLEAR

Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability

Microsoft Windows Win32k contains an improper resource shutdown or release vulnerability that allows for local, authenticated privilege escalation. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.

Facts

  • Vendor: Microsoft
  • Product: Windows
  • CVSS: 7.8
  • EPSS (probability of exploitation within 30 days): 22.2 %
  • On CISA's Known Exploited Vulnerabilities list since: 3 March 2025
  • First known exploitation: 3 March 2025
  • Used in ransomware campaigns (per CISA): Yes
  • CISA's deadline for US federal agencies: 24 March 2025
  • Weakness: CWE-404
  • First seen by Risk Letters: 3 March 2025

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD