Is CVE-2018-8405 actively exploited?

Yes. CVE-2018-8405 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2018-8405 be exploited remotely?

The attack vector of CVE-2018-8405 has not been classified yet.

What is the CVSS score of CVE-2018-8405?

CVE-2018-8405 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2018-8405

HIGHCISA KEVIN THE WILD

CVE-2018-8405

Published: March 28, 2022

EPSS:49.99%probability of exploitation in 30 daysPercentile:97.8th

Official Description

An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory.

NVD Source

CISA KEV Advisory

Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability

An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory.

Added to KEV: 2022-03-28Federal patch deadline: 2022-04-18⚠ USED IN RANSOMWARE CAMPAIGNS

Required Action (CISA)

Apply updates per vendor instructions.

Risk Analysis

This elevation of privilege vulnerability in the DirectX Graphics Kernel (DXGKRNL) driver is caused by improper handling of objects in memory, which could allow an attacker to gain elevated privileges. The high EPSS score of 0.49990 and its inclusion in CISA's KEV indicate that this is a critical and actively exploited vulnerability.

This vulnerability is actively exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog. Exploitation typically requires local access or another vulnerability to achieve initial access.

Recommended Action

Apply the latest security updates for the DirectX Graphics Kernel (DXGKRNL) driver to mitigate this memory handling vulnerability. Regularly update operating system components and drivers to their most secure versions.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2018-8405 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2018-8405 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.