CVE-2018-0877 json
The Desktop Bridge Virtual File System (VFS) in Windows 10 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allow…
published 2018-03-14 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-1668
- cvss
- 7.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.3%
- EPSS 3.3% chance of exploitation in 30 days, percentile 88%
- public exploits
- 1
- Exploit-DB
Summary
The Desktop Bridge Virtual File System (VFS) in Windows 10 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an elevation of privilege vulnerability due to how file paths are managed, aka "Windows Desktop Bridge VFS Elevation of Privilege Vulnerability".
Patch / fix
Timeline
- Published
- First public exploit (EDB-44313)
Exploit prediction
3.35% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-44313 Microsoft Windows - Desktop Bridge VFS Privilege Escalation local, 2018-03-20
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 7.8 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Affected products
- Microsoft Corporation Windows Desktop Bridge Virtual File System
References
-
portal.msrc.microsoft.com
/en-US/security-guidance/advisory/CVE-2018-0877
patch, vendor-advisory
-
exploit-db.com
/exploits/44313/
exploit, third-party-advisory, vdb-entry
-
securitytracker.com
/id/1040520
vdb-entry, third-party-advisory
-
securityfocus.com
/bid/103227
vdb-entry, third-party-advisory
Sources
- CVE List CVE-2018-0877
- NVD CVE-2018-0877
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.