CVE-2018-8342

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length of a buffer prior to copying memory to it, aka "Windows NDIS Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2008 R2. This CVE ID is unique from CVE-2018-8343.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

VendorProductVersions
MicrosoftWindows 732-bit Systems Service Pack 1; x64-based Systems Service Pack 1
MicrosoftWindows Server 2008 R2Itanium-Based Systems Service Pack 1; x64-based Systems Service Pack 1; x64-based Systems Service Pack 1 (Server Core installation)

References

Timeline

Published
Aug 15, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-83437.8An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length CVE-2018-83448.8A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "MicrosoCVE-2018-83457.5A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed, aka "LCVE-2018-83468.8A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed, aka "LCVE-2018-83477.8An elevation of privilege vulnerability exists in Microsoft Windows when the Windows kernel fails to properly handle parsing of certain symbCVE-2018-83484.7An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel InformationCVE-2018-83498.8A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "MicrosCVE-2018-83508.8A remote code execution vulnerability exists when Microsoft Windows PDF Library improperly handles objects in memory, aka "Windows PDF RemotCVE-2018-83516.5An information disclosure vulnerability exists when affected Microsoft browsers improperly allow cross-frame interaction, aka "Microsoft BroCVE-2018-83537.5A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "ScripCVE-2018-83547.5A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "ScriptinCVE-2018-83557.5A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting
CVE-2018-8342: High severity, CVSS 7.8 | Vulnix