CVE-2018-8639: Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
Microsoft Windows Win32k contains an improper resource shutdown or release vulnerability that allows for local, authenticated privilege escalation. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.
CSIRTS triage
- What
- An improper resource shutdown or release vulnerability allows for local privilege escalation to run arbitrary code in kernel mode.
- Who is affected
- Authenticated users on Microsoft Windows systems with the Win32k component.
- Urgency
- Remediation is urgent due to active exploitation and critical severity.
- Action
- Install the latest security updates from Microsoft.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Windows
Get an email when a new Windows advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2018-8639
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation confirmedCVE-2018-8639Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 97% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2018-8639 | coverage & exploitation status | NVD · CVE.org |
Recent advisories for Microsoft Windows Win32k
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- criticalexploitedCVE-2025-24983: Microsoft Windows Win32k Use-After-Free Vulnerabilitycisa-kev · 2025-03-11
- criticalexploitedCVE-2021-40449: Microsoft Windows Win32k Privilege Escalation Vulnerabilitycisa-kev · 2021-11-17
More from CISA Known Exploited Vulnerabilities
- criticalCVE-2026-48939: iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability2026-07-10
- criticalCVE-2026-56291: Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability2026-07-10
- criticalCVE-2026-48908: JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability2026-07-07
- criticalCVE-2026-55255: Langflow Authorization Bypass Through User-Controlled Key Vulnerability2026-07-07
- criticalCVE-2026-48282: Adobe ColdFusion Path Traversal Vulnerability2026-07-07