CVE-2018-0824

high · 8.8Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Added 2024-08-05Remediation due 2024-08-26

A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Microsoft COM for Windows Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

8.8

CVSS

73.2%

EPSS (exploit prob.)

99th

EPSS percentile

2018-05-09

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses

CWE-502

Affected products

Vendor	Product	Affected versions
microsoft	windows_10_1507	all versions
microsoft	windows_10_1607	all versions
microsoft	windows_10_1703	all versions
microsoft	windows_10_1709	all versions
microsoft	windows_10_1803	all versions
microsoft	windows_7	all versions
microsoft	windows_8.1	all versions
microsoft	windows_rt_8.1	all versions
microsoft	windows_server_1709	all versions
microsoft	windows_server_1803	all versions
microsoft	windows_server_2008	all versions
microsoft	windows_server_2008	r2
microsoft	windows_server_2008	r2
microsoft	windows_server_2012	all versions
microsoft	windows_server_2012	r2
microsoft	windows_server_2016	all versions

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2018-0824