CVE-2017-8486: Infoleak

Published Jul 11, 2017

Updated

Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an information disclosure due to the way it handles objects in memory, aka "Win32k Information Disclosure Vulnerability".

Affected Software

12 affected components

Microsoft Windows 10

Microsoft Windows 10=1511

Microsoft Windows 10=1607

Microsoft Windows 10=1703

Microsoft Windows 7=sp1

Microsoft Windows 8.1

Microsoft Windows RT 8.1

Microsoft Windows Server 2008=sp2

Microsoft Windows Server 2008=r2-sp1

Microsoft Windows Server 2012

Microsoft Windows Server 2012=r2

Microsoft Windows Server 2016

Remediation

Patch Available

https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8486

Event History

Jul 11, 2017

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

DescriptionWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Exploitation requires local access and low-level privileges. The CVSS vector indicates no user interaction is required, but attack complexity is high.

What is the likely impact if exploitation succeeds?

The vulnerability can disclose information from memory, with a high confidentiality impact. The provided CVSS assessment indicates no integrity or availability impact.

Which Windows releases are listed as affected?

Affected releases include Windows 7 SP1; Windows Server 2008 SP2 and R2 SP1; Windows 8.1 and Windows RT 8.1; Windows Server 2012 and R2; Windows 10 Gold, 1511, 1607, and 1703; and Windows Server 2016.

Is a fix available?

Yes. A patch is available.