Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2017-8480: Windows OS kernel may leak data to logged‑in attackers

CVE-2017-8480 · published 9 years ago

Summary

Several Windows versions, including Windows 7, 8.1, 10, Server 2008, 2012, 2016 and Windows RT 8.1, have a kernel issue that lets someone with a user account run a crafted program and see internal system information. This exposure could help an attacker move deeper into the network. Apply the latest Microsoft security updates to fix the problem.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
microsoft	windows_10	1511 1607 1703 `cpe:2.3:o:microsoft:windows_10:-:::::::*`
microsoft	windows_7	All versions `cpe:2.3:o:microsoft:windows_7:-:sp1::::::`
microsoft	windows_8.1	All versions `cpe:2.3:o:microsoft:windows_8.1:-:::::::*`
microsoft	windows_rt_8.1	All versions `cpe:2.3:o:microsoft:windows_rt_8.1:-:::::::*`
microsoft	windows_server_2008	r2 `cpe:2.3:o:microsoft:windows_server_2008:-:sp2::::::`
microsoft	windows_server_2012	r2 `cpe:2.3:o:microsoft:windows_server_2012:-:::::::*`
microsoft	windows_server_2016	All versions `cpe:2.3:o:microsoft:windows_server_2016:-:::::::*`

Original advisory text

The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to obtain information via a specially crafted application. aka "Windows Kernel Information Disclosure Vulnerability," a different vulnerability than CVE-2017-8492, CVE-2017-8491, CVE-2017-8490, CVE-2017-8489, CVE-2017-8488, CVE-2017-8485, CVE-2017-8483, CVE-2017-8482, CVE-2017-8479, CVE-2017-8478, CVE-2017-8476, CVE-2017-8474, CVE-2017-8469, CVE-2017-8462, CVE-2017-0300, CVE-2017-0299, and CVE-2017-0297.

References

http://www.securityfocus.com/bid/98857 Third Party Advisory VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8480 Patch Vendor Advisory
https://www.exploit-db.com/exploits/42233/ Exploit Third Party Advisory VDB Entry

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

5.0 Medium

Exploitation

3% chance of attack within 30 days

Type

CWE-200Information Exposure

Timeline

Published15 Jun 2017

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2017-8480 · NVD

Track software like this

Free during beta