CVE-2018-8406: Microsoft DirectX Graphics Kernel driver elevation of privilege

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityConfirmed exploitation in the wild and known ransomware use, with a CVSS of 7.8, though it requires local low-privileged access rather than being remotely reachable.

What it is

The DirectX Graphics Kernel (DXGKRNL) driver mishandles objects in memory, allowing a local attacker to elevate privileges. It affects Windows 10, Windows 10 Servers and Windows Server 2016. The flaw is a resource-handling issue (CWE-404) that Microsoft patched in August 2018.

Impact

A local attacker gains full control of confidentiality, integrity and availability on the affected host, effectively escalating from a low-privileged account to kernel-level code execution. This enables disabling security controls, persisting, or moving laterally.

Attack surface

Reached locally through the DXGKRNL driver; the CVSS vector (AV:L/PR:L/UI:N) indicates the attacker needs local access and low privileges but no user interaction. No remote or network vector is described.

Exploitation

CISA added it to the Known Exploited Vulnerabilities catalog on 2022-03-28 with known ransomware campaign use, so exploitation in the wild is confirmed. EPSS 30-day probability is 0.03444 (88th percentile), a moderate score.

What to do

• Apply the Microsoft security update for CVE-2018-8406 (August 2018) to all affected Windows 10 and Windows Server builds.
• Prioritize patching on systems where low-privileged local access is common, such as multi-user endpoints and terminal servers.
• Restrict local logon and interactive access to only trusted users to reduce exposure to the local attack vector.
• Verify patch compliance against the CISA KEV due date (2022-04-18) and track any remaining unpatched hosts.

Detection

• Monitor for unexpected privilege escalation or SYSTEM-level process creation originating from low-privileged user sessions.
• Alert on suspicious driver interaction or memory corruption indicators involving dxgkrnl.sys.
• Correlate endpoint telemetry for known post-exploitation behavior tied to ransomware campaigns on unpatched Windows 10/Server 2016 hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.