CVE-2018-8438

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system, aka "Windows Hyper-V Denial of Service Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2016, Windows 8.1, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8436, CVE-2018-8437.

Metrics

CVSS 3.0 6.8/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

Weakness enumeration

CWE-20

Affected software

VendorProductVersions
MicrosoftWindows Server 2012 R2(Server Core installation)
MicrosoftWindows RT 8.1Windows RT 8.1
MicrosoftWindows Server 2016(Server Core installation)
MicrosoftWindows 8.132-bit systems; x64-based systems
MicrosoftWindows 1032-bit Systems; Version 1607 for 32-bit Systems; Version 1607 for x64-based Systems; Version 1703 for 32-bit Systems; Version 1703 for x64-based Systems; Version 1709 for 32-bit Systems; Version 1709 for x64-based Systems; Version 1803 for 32-bit Systems; Version 1803 for x64-based Systems; x64-based Systems
MicrosoftWindows 10 Serversversion 1709 (Server Core Installation); version 1803 (Server Core Installation)

References

Timeline

Published
Sep 13, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-84398.4A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated usCVE-2018-84407.8An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ACVE-2018-84417.8An elevation of privilege vulnerability exists due to an integer overflow in Windows Subsystem for Linux, aka "Windows Subsystem for Linux ECVE-2018-84425.5An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel InformationCVE-2018-84435.5An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel InformationCVE-2018-84445.9An information disclosure vulnerability exists in the way that the Microsoft Server Message Block 2.0 (SMBv2) server handles certain requestCVE-2018-84455.5An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel InformationCVE-2018-84465.5An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel InformationCVE-2018-84477.5A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory CorCVE-2018-84485.4An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka "CVE-2018-84493.3A security feature bypass exists when Device Guard incorrectly validates an untrusted file, aka "Device Guard Security Feature Bypass VulnerCVE-2018-84508.8A remote code execution vulnerability exists when Windows Search handles objects in memory, aka "Windows Search Remote Code Execution Vulner
CVE-2018-8438: Medium severity, CVSS 6.8 | Vulnix