CVE-2018-8405

Microsoft's DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, allowing a local attacker who can already execute code on a target machine to elevate privileges to kernel/SYSTEM level (CVSS 7.8, CWE-404). It is triggered by running a specially crafted local application against the vulnerable driver on affected Windows clients and servers; no remote or unauthenticated access is required. Successful exploitation yields full system compromise (confidentiality, integrity, and availability impact at the highest privilege level), and ransomware operators are known to chain such local privilege escalations onto an initial foothold. Affected products are Windows 8.1, Windows RT 8.1, Windows 10 builds 1507 through 1803, and Windows Server 2012, 2012 R2, 2016, and the Server 1709/1803 Semi-Annual Channel releases. The flaw was fixed in Microsoft's July 2018 security updates, but it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-28 with known ransomware use, confirming exploitation in the wild against unpatched systems.

What to do: Verify the July 2018 (or later) cumulative update or monthly rollup is installed on all Windows 8.1/RT 8.1, Windows 10 1507-1803, Windows Server 2012/2012 R2, 2016, and 1709/1803 hosts, as KEV listing requires remediation per vendor instructions. Prioritize systems where local code execution is plausible (user workstations, RDP-exposed or otherwise accessed servers) since ransomware operators are known to exploit this flaw post-foothold. Windows 8.1, Windows RT 8.1, and Windows Server 2012/2012 R2 are now end-of-support, so plan migration or compensating hardening for any remaining unpatched legacy hosts.