CVE-2018-8407

5.5 mediumEPSS 1.7%

An information disclosure vulnerability exists when "Kernel Remote Procedure Call Provider" driver improperly initializes objects in memory, aka "MSRPC Information Disclosure Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

Severity

CVSS 3.0

5.5 medium

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 1.7% chance of exploitation in the next 30 days; higher than 76% of CVEs (scores of 2026-10-31)
CWE: CWE-665
Published: 2018-11-14
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

microsoft:windows_10
microsoft:windows_7
microsoft:windows_8.1
microsoft:windows_rt_8.1
microsoft:windows_server_2008
microsoft:windows_server_2012
microsoft:windows_server_2016
microsoft:windows_server_2019

References

http://www.securityfocus.com/bid/105794
http://www.securitytracker.com/id/1042123
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8407
http://www.securityfocus.com/bid/105794
http://www.securitytracker.com/id/1042123

Check your stack JSON