An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead t…

published 2018-04-12 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-1751

cvss: 5.5; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 3.4%; EPSS 3.4% chance of exploitation in 30 days, percentile 89%
public exploits: 1; Exploit-DB

An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address Space Layout Randomization (ASLR) bypass, aka "Windows Kernel Information Disclosure Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-0887, CVE-2018-0960, CVE-2018-0968, CVE-2018-0969, CVE-2018-0970, CVE-2018-0971, CVE-2018-0973, CVE-2018-0974, CVE-2018-0975.

Patch / fix

links 1

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0972 advisory

Timeline

2018-04-12 Published
2018-04-16 First public exploit (EDB-44462)

Exploit prediction

3.44% chance of exploitation in the next 30 days, higher than 89% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

EDB-44462 Microsoft Windows - 'nt!NtQueryInformationTransactionManager (TransactionManagerRecoveryInformation)' Kernel Pool Memory Disclosure dos, 2018-04-16

CVSS scores

assigned by	version	score	vector
NVD	3.0	5.5	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD	2.0	2.1	AV:L/AC:L/Au:N/C:P/I:N/A:N

Affected products

Microsoft Windows 7
Microsoft Windows Server 2012 R2
Microsoft Windows RT 8.1
Microsoft Windows Server 2008
Microsoft Windows Server 2012
Microsoft Windows 8.1
Microsoft Windows Server 2016
Microsoft Windows Server 2008 R2
Microsoft Windows 10
Microsoft Windows 10 Servers

References

portal.msrc.microsoft.com /en-US/security-guidance/advisory/CVE-2018-0972
patch, vendor-advisory
exploit-db.com /exploits/44462/
exploit, third-party-advisory, vdb-entry
securityfocus.com /bid/103659
vdb-entry, third-party-advisory
securitytracker.com /id/1040657
vdb-entry, third-party-advisory

Sources

CVE List CVE-2018-0972
NVD CVE-2018-0972

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary