CVE-2018-8432 : A remote code execution vulnerability exists in the way that Microsoft Graphics

A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka "Microsoft Graphics Components Remote Code Execution Vulnerability." This affects Windows 7, Microsoft Office, Microsoft Office Word Viewer, Office 365 ProPlus, Microsoft Excel Viewer, Microsoft PowerPoint Viewer, Windows Server 2019, Windows Server 2008 R2, Windows 10, Windows Server 2008.

Published 2018-10-10 13:29:02

Updated 2020-08-24 17:37:01

Source Microsoft Corporation

View at NVD, CVE.org

Vulnerability category: Execute code

Products affected by CVE-2018-8432

Microsoft » Office » Version: 2019
cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:*:*
Matching versions
Microsoft » Office » Version: 2016 Mac Os Edition
cpe:2.3:a:microsoft:office:2016:*:mac_os:*:*:*:*:*
Matching versions
Microsoft » Excel Viewer » Version: 2007 Update SP3
cpe:2.3:a:microsoft:excel_viewer:2007:sp3:*:*:*:*:*:*
Matching versions
Microsoft » Word Viewer » Version: N/A
cpe:2.3:a:microsoft:word_viewer:-:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2008 » Version: R2 Update SP1
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2008 » Version: N/A Update SP2
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*
Matching versions
Microsoft » Office Compatibility Pack » Version: N/A Update SP3
cpe:2.3:a:microsoft:office_compatibility_pack:-:sp3:*:*:*:*:*:*
Matching versions
Microsoft » Windows 7 » Version: N/A Update SP1
cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*
Matching versions
Microsoft » Powerpoint Viewer » Version: 2007
cpe:2.3:a:microsoft:powerpoint_viewer:2007:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 10 » Version: 1809
cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2019 » Version: N/A
cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*
Matching versions
Microsoft » Office 365 Proplus » Version: N/A
cpe:2.3:a:microsoft:office_365_proplus:-:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2018-8432

EPSS FAQ

30.62%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 97 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-8432

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C	8.6	10.0	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
7.8	HIGH	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High

References for CVE-2018-8432

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8432

CVE-2018-8432 | Microsoft Graphics Components Remote Code Execution Vulnerability
Patch;Vendor Advisory
http://www.securityfocus.com/bid/105458

Microsoft Windows Graphics Component CVE-2018-8432 Remote Code Execution Vulnerability
Third Party Advisory;VDB Entry
http://www.securitytracker.com/id/1041823

Microsoft GDI+ Multiple Bugs Lets Local Users Gain Potentially Sensitive Information and Obtain Elevated Privileges - SecurityTracker
Third Party Advisory;VDB Entry

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2018-8432

Products affected by CVE-2018-8432

Exploit prediction scoring system (EPSS) score for CVE-2018-8432

CVSS scores for CVE-2018-8432

References for CVE-2018-8432