HighPublic exploit

Privilege Escalation in Windows SMB Server via IO Manager Access Mode Handling

IdentifiersCVE-2018-0749CWE-269

CVE-2018-0749 is an elevation of privilege vulnerability in the Microsoft Server Message Block (SMB) Server component of multiple Windows versions. The vulnerability arises from a logic flaw in the Windows kernel IO manager's handling of access mode and security checks when opening device objects. Specifically, the bug is triggered when kernel APIs such as IoCreateFile or IoCreateFileEx are called with IO_NO_PARAMETER_CHECKING and IO_FORCE_ACCESS_CHECK flags, but without OBJ_FORCE_ACCESS_CHECK. This can result in the SMB server and other drivers relying solely on the RequestorMode field for security decisions, inadvertently bypassing necessary security checks and allowing local privilege escalation.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation of this vulnerability allows a local attacker to escalate privileges on the affected system. The attacker could potentially gain SYSTEM-level access by exploiting the logic flaw in the SMB server's handling of access checks, leading to full compromise of the affected machine.

Mitigation

If you can’t patch tonight, do this now.

In addition to applying patches, organizations should ensure that only trusted users have local access to Windows systems, as this is a local privilege escalation vulnerability. Developers of kernel drivers should review their use of access check flags and avoid relying solely on RequestorMode for security decisions, following updated Microsoft documentation and best practices.

Remediation

Patch, then assume compromise.

Microsoft has released security updates addressing this vulnerability. Administrators should apply the latest patches for all affected Windows versions, as provided in the official Microsoft security advisory for CVE-2018-0749. The fix involves correcting the logic in the SMB server and other affected drivers to ensure proper enforcement of security access checks regardless of the RequestorMode field.

PUBLIC EXPLOITS

Exploits

No valid public exploits. Mallory filtered out 1 candidate as fakes, detection scripts, or README-only repos.

VALID 0 / 1 TOTALView more in app

All candidate exploits were filtered out by Mallory's validation.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Microsoft CorporationWindows 10operating_system

Microsoft CorporationWindows 7operating_system

Microsoft CorporationWindows 8.1operating_system

Microsoft CorporationWindows Server 2008operating_system

Microsoft CorporationWindows Server 2012operating_system

Microsoft CorporationWindows Server 2016operating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

No public activity tracked yet. Mallory keeps watching.

0 SOURCESView more in app

No public activity observed for this vulnerability.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity