CVE-2018-8554 — Improper Resource Shutdown or Release in Microsoft Windows 10

CWE-404 — Improper Resource Shutdown or Release4 documents4 sources

Severity

7.8HIGHNVD

EPSS

0.5%

top 35.16%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Microsoft Windows 10 Microsoft Windows 10 Servers Microsoft Windows Server 2019 +1 more

Timeline

PublishedNov 14

Latest updateMay 13

Description

An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka "DirectX Elevation of Privilege Vulnerability." This affects Windows 10 Servers, Windows 10, Windows Server 2019. This CVE ID is unique from CVE-2018-8485, CVE-2018-8561.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages5 packages

▶CVEListV5microsoft/windows_10_serversversion 1803 (Server Core Installation)

▶CVEListV5microsoft/windows_server_2019(Server Core installation)

▶NVDmicrosoft/windows_server1803

▶CVEListV5microsoft/windows_104 versions+3

▶NVDmicrosoft/windows_101803, 1809+1

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

GHSA

GHSA-phrx-vrcg-3v5j: An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka "DirectX Elevation of Privilege Vulnerability↗2022-05-13

▶

CVEList

CVE-2018-8554: An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka "DirectX Elevation of Privilege Vulnerability↗2018-11-14

▶

📋Vendor Advisories

Microsoft

DirectX Elevation of Privilege Vulnerability↗2018-11-13

▶