CVE-2018-8397

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka "GDI+ Remote Code Execution Vulnerability." This affects Windows Server 2008, Windows 7, Windows Server 2008 R2.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Microsoft	Windows Server 2008	32-bit Systems Service Pack 2; 32-bit Systems Service Pack 2 (Server Core installation); Itanium-Based Systems Service Pack 2; x64-based Systems Service Pack 2; x64-based Systems Service Pack 2 (Server Core installation)
Microsoft	Windows 7	32-bit Systems Service Pack 1; x64-based Systems Service Pack 1
Microsoft	Windows Server 2008 R2	Itanium-Based Systems Service Pack 1; x64-based Systems Service Pack 1; x64-based Systems Service Pack 1 (Server Core installation)

References

http://www.securityfocus.com/bid/104994Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041460Third Party Advisory, VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8397Patch, Vendor Advisory
http://www.securityfocus.com/bid/104994Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041460Third Party Advisory, VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8397Patch, Vendor Advisory

Timeline

Published: Aug 15, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-83986.5An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows CVE-2018-83997.0An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k CVE-2018-84007.8An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "CVE-2018-84017.8An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "CVE-2018-84037.5A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka "Microsoft Browser Memory Corr CVE-2018-84047.0An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k CVE-2018-84057.8An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "CVE-2018-84067.8An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "CVE-2018-84075.5An information disclosure vulnerability exists when "Kernel Remote Procedure Call Provider" driver improperly initializes objects in memory,CVE-2018-84085.5An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory, aka "Windows Kernel Informa CVE-2018-84097.5A denial of service vulnerability exists when System.IO.Pipelines improperly handles requests, aka "System.IO.Pipelines Denial of Service." CVE-2018-84107.8An elevation of privilege vulnerability exists when the Windows Kernel API improperly handles registry objects in memory, aka "Windows Regis