Microsoft Windows 8 vulnerabilities

254 CVEs affecting Microsoft Windows 8, 16 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-6947, published 2018-02-28.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-1635: Microsoft HTTP.sys Remote Code Execution Vulnerability, published 2015-04-14. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-02-10. EPSS: 100% chance of exploitation in the next 30 days. HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP…
CVE-2014-6332: Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability, published 2014-11-11. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 94.9% chance of exploitation in the next 30 days. OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT…
CVE-2014-6324: Microsoft Kerberos Key Distribution Center (KDC) Privilege Escalation Vulnerability, published 2014-11-18. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 87.3% chance of exploitation in the next 30 days. The Kerberos Key Distribution Center (KDC) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012…
CVE-2014-4113: Microsoft Win32k Privilege Escalation Vulnerability, published 2014-10-15. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-05-04. EPSS: 86.9% chance of exploitation in the next 30 days. win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and…
CVE-2015-2426: Microsoft Windows Adobe Type Manager Library Remote Code Execution Vulnerability, published 2015-07-20. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-03-28. EPSS: 86.6% chance of exploitation in the next 30 days. Buffer underflow in atmfd.dll in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012…
CVE-2014-4114: Microsoft Windows Object Linking & Embedding (OLE) Remote Code Execution Vulnerability, published 2014-10-15. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 81.6% chance of exploitation in the next 30 days. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute…
CVE-2014-6352: Microsoft Windows Code Injection Vulnerability, published 2014-10-22. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-02-25. EPSS: 77.5% chance of exploitation in the next 30 days. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute…
CVE-2015-0016: Microsoft Windows TS WebProxy Directory Traversal Vulnerability, published 2015-01-13. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-05-25. EPSS: 75.8% chance of exploitation in the next 30 days. Directory traversal vulnerability in the TS WebProxy (aka TSWbPrxy) component in Microsoft Windows Vista SP2, Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012…
CVE-2013-3918: Microsoft Windows Out-of-Bounds Write Vulnerability, published 2013-11-12. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2025-10-06. EPSS: 73.7% chance of exploitation in the next 30 days. The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7…
CVE-2014-1812: Microsoft Windows Group Policy Preferences Password Privilege Escalation Vulnerability, published 2014-05-14. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 65.1% chance of exploitation in the next 30 days. The Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does not properly handle…

Latest

CVE-2018-6947, published 2018-02-28. High severity, CVSS 7.8. EPSS: 3.1% chance of exploitation in the next 30 days. An uninitialised stack variable in the nxfuse component that is part of the Open Source DokanFS library shipped with NoMachine 6.0.66_2 and earlier allows a local low privileged user to gain…
CVE-2018-7250, published 2018-02-26. Medium severity, CVSS 5.5. EPSS: 2.9% chance of exploitation in the next 30 days. An issue was discovered in secdrv.sys as shipped in Microsoft Windows Vista, Windows 7, Windows 8, and Windows 8.1 before KB3086255, and as shipped in Macrovision SafeDisc. An uninitialized kernel…
CVE-2018-7249, published 2018-02-26. High severity, CVSS 7.0. EPSS: 1.5% chance of exploitation in the next 30 days. An issue was discovered in secdrv.sys as shipped in Microsoft Windows Vista, Windows 7, Windows 8, and Windows 8.1 before KB3086255, and as shipped in Macrovision SafeDisc. Two carefully timed calls…
CVE-2017-0050, published 2017-03-17. High severity, CVSS 7.8. EPSS: 1.5% chance of exploitation in the next 30 days. The kernel API in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7; Windows 8; Windows 10 Gold, 1511, and 1607; Windows RT 8.1; Windows Server 2012 Gold and R2; and Windows…
CVE-2016-0018, published 2016-01-13. High severity, CVSS 7.3. EPSS: 13.5% chance of exploitation in the next 30 days. Microsoft Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 R2, and Windows 10 Gold and 1511 mishandle DLL loading, which allows local users to gain privileges via a crafted application, aka…
CVE-2016-0016, published 2016-01-13. High severity, CVSS 7.8. EPSS: 29.7% chance of exploitation in the next 30 days. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511…
CVE-2016-0015, published 2016-01-13. High severity, CVSS 7.8. EPSS: 49.4% chance of exploitation in the next 30 days. DirectShow in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 Gold and 1511 allows remote…
CVE-2016-0014, published 2016-01-13. High severity, CVSS 7.8. EPSS: 2.4% chance of exploitation in the next 30 days. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511…
CVE-2016-0008, published 2016-01-13. Medium severity, CVSS 4.3. EPSS: 13.8% chance of exploitation in the next 30 days. The graphics device interface in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1…
CVE-2016-0007, published 2016-01-13. High severity, CVSS 7.8. EPSS: 5.2% chance of exploitation in the next 30 days. The sandbox implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and…