CVE-2018-8396: An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows GDI Information Disclosure…

Medium severity · published Aug 15, 2018

CVE-2018-8396

An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows GDI Information Disclosure…

4.7

CVSS

2.6%

EPSS

On KEV

Description

An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows GDI Information Disclosure Vulnerability." This affects Windows Server 2008, Windows 7, Windows Server 2008 R2. This CVE ID is unique from CVE-2018-8394, CVE-2018-8398.

CVSS vector

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack vector

Local

Complexity

High

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)2.6% · higher than 86% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Windows 7 · Microsoft

32-bit Systems Service Pack 1; x64-based Systems Service Pack 1 · source: vendor, NVD

Windows Server 2008 · Microsoft

32-bit Systems Service Pack 2; 32-bit Systems Service Pack 2 (Server Core installation); Itanium-Based Systems Service Pack 2; x64-based Systems Service Pack 2; x64-based Systems Service Pack 2 (Server Core installation) · source: vendor, NVD

Windows Server 2008 R2 · Microsoft

Itanium-Based Systems Service Pack 1; x64-based Systems Service Pack 1; x64-based Systems Service Pack 1 (Server Core installation) · source: vendor

Affected product

Windows 7

Microsoft

All Windows 7 CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2018-8396

CVE.org

https://www.cve.org/CVERecord?id=CVE-2018-8396

Third Party Advisory

http://www.securityfocus.com/bid/105002

Third Party Advisory

http://www.securitytracker.com/id/1041460

Patch

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8396