CVE-2018-8405: Microsoft DirectX Graphics Kernel driver elevation of privilege

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is a local privilege escalation with high confidentiality, integrity and availability impact, listed in CISA KEV with known ransomware use, though it requires an existing local foothold.

What it is

The DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, allowing an elevation of privilege on affected Windows client and server versions. The flaw is tracked as CWE-404 (improper resource shutdown) and Microsoft patched it in August 2018. It matters because it is listed in CISA's Known Exploited Vulnerabilities catalog with known ransomware campaign use.

Impact

An attacker who already has code running on the host can gain elevated privileges, typically SYSTEM, on the affected Windows system. That level of access enables further compromise such as disabling defenses, dumping credentials or deploying ransomware.

Attack surface

The CVSS vector is local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), so the attacker must already have a foothold on the machine and reach the driver through local API calls. No remote or network vector is described.

Exploitation

CISA added this CVE to the KEV catalog on 2022-03-28 with a due date of 2022-04-18 and flags known ransomware campaign use; EPSS 30-day probability is about 3.4 percent (88th percentile). The record does not name specific ransomware groups.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2018-8405 on all affected Windows versions.
• Prioritize patching of internet-facing and high-value endpoints, since KEV lists this as exploited in ransomware campaigns.
• Restrict local interactive logon and limit low-privileged code execution on sensitive hosts to reduce the foothold needed for this local privilege escalation.
• Verify patch coverage across the full affected product list, including Windows 8.1, RT 8.1, Windows 10 builds 1507 through 1803, and Windows Server 2012, 2016, 1709 and 1803.

Detection

• Monitor for unexpected privilege escalation to SYSTEM or unusual token manipulation on hosts running unpatched Windows builds.
• Alert on suspicious processes loading or interacting with dxgkrnl.sys outside normal graphics workloads.
• Correlate local privilege escalation events with subsequent ransomware precursor behavior such as shadow copy deletion or credential dumping.
• Audit endpoints against the KEV due date to confirm the August 2018 update is installed.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.