CVE-2018-8406

An elevation-of-privilege flaw exists in the Microsoft DirectX Graphics Kernel (DXGKRNL) driver, which improperly handles objects in memory (CWE-404). A local attacker with low privileges who can already run code on an affected machine can trigger the mishandled object handling to execute code at kernel level. Successful exploitation yields high confidentiality, integrity and availability impact — effectively full control of the host — which fits post-compromise escalation in ransomware tradecraft. Affected platforms are Windows 10 builds 1507, 1607, 1703, 1709 and 1803, and Windows Server 2016, 1709 and 1803; it is one of a family of sibling DXGKRNL EoP bugs (CVE-2018-8400, 8401, 8405, 8406). The flaw is under active exploitation: it was added to the CISA KEV on 2022-03-28 with known ransomware use, and Microsoft shipped fixes in July 2018 security updates.

What to do: Apply Microsoft's July 2018 (or any later) cumulative/security updates to Windows 10 1507–1803 and Windows Server 2016/1709/1803 — any current servicing build resolves this DXGKRNL bug. Because the CVE is KEV-listed with known ransomware use, prioritize patching unpatched legacy Windows 10/Server 2016-era hosts, especially endpoints where users run unprivileged code; as an interim mitigation, limit local code execution (application control, removing users' ability to run arbitrary binaries) and monitor for post-authentication privilege-escalation activity.