CVE-2018-8166

CVE-2018-8166 is an elevation of privilege vulnerability in the Win32k component of Windows, affecting numerous versions including Windows 7, 8.1, 10, and various Server editions. This flaw allows an attacker to gain elevated privileges if they can successfully exploit how the Win32k component handles objects in memory. With a CVSS score of 7.0 (HIGH), exploitation requires local access and high attack complexity, but can lead to high impact on confidentiality, integrity, and availability. While no public exploit code is readily available (Metasploit, Nuclei, ExploitDB), and it's not listed in CISA's KEV catalog, it received some media attention during Microsoft's May 2018 Patch Tuesday.