CVE-2018-8454 — Sensitive Information Exposure in Microsoft Windows 10

CWE-200 — Sensitive Information Exposure4 documents4 sources

Severity

5.5MEDIUMNVD

EPSS

5.5%

top 9.79%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Microsoft Windows 10 Microsoft Windows 10 Servers Microsoft Windows Server 2019 +1 more

Timeline

PublishedNov 14

Latest updateMay 14

Description

An information disclosure vulnerability exists when Windows Audio Service fails to properly handle objects in memory, aka "Windows Audio Service Information Disclosure Vulnerability." This affects Windows 10 Servers, Windows 10, Windows Server 2019.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages5 packages

▶CVEListV5microsoft/windows_10_serversversion 1709 (Server Core Installation), version 1803 (Server Core Installation)+1

▶CVEListV5microsoft/windows_server_2019(Server Core installation)

▶NVDmicrosoft/windows1709, 1803+1

▶CVEListV5microsoft/windows_109 versions+8

▶NVDmicrosoft/windows_101709, 1803, 1809+2

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

GHSA

GHSA-c8jc-rcqg-f45x: An information disclosure vulnerability exists when Windows Audio Service fails to properly handle objects in memory, aka "Windows Audio Service Infor↗2022-05-14

▶

CVEList

CVE-2018-8454: An information disclosure vulnerability exists when Windows Audio Service fails to properly handle objects in memory, aka "Windows Audio Service Infor↗2018-11-14

▶

📋Vendor Advisories

Microsoft

Windows Audio Service Information Disclosure Vulnerability↗2018-11-13

▶