CVE-2018-8435

MediumCVSS 4.2/10Last modified Jun 17, 2026

Description

A security feature bypass vulnerability exists when Windows Hyper-V BIOS loader fails to provide a high-entropy source, aka "Windows Hyper-V Security Feature Bypass Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers.

Metrics

CVSS 3.0 4.2/10CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-331

Affected software

VendorProductVersions
MicrosoftWindows Server 2016(Server Core installation)
MicrosoftWindows 10Version 1607 for x64-based Systems; Version 1703 for x64-based Systems; Version 1709 for x64-based Systems; Version 1803 for x64-based Systems; x64-based Systems
MicrosoftWindows 10 Serversversion 1709 (Server Core Installation); version 1803 (Server Core Installation)

References

Timeline

Published
Sep 13, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-84366.2A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privCVE-2018-84376.2A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privCVE-2018-84386.8A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privCVE-2018-84398.4A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated usCVE-2018-84407.8An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ACVE-2018-84417.8An elevation of privilege vulnerability exists due to an integer overflow in Windows Subsystem for Linux, aka "Windows Subsystem for Linux ECVE-2018-84425.5An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel InformationCVE-2018-84435.5An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel InformationCVE-2018-84445.9An information disclosure vulnerability exists in the way that the Microsoft Server Message Block 2.0 (SMBv2) server handles certain requestCVE-2018-84455.5An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel InformationCVE-2018-84465.5An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel InformationCVE-2018-84477.5A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Cor
CVE-2018-8435: Medium severity, CVSS 4.2 | Vulnix