CVE-2018-8577 : A remote code execution vulnerability exists in Microsoft Excel software when th

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Remote Code Execution Vulnerability." This affects Microsoft Office, Office 365 ProPlus, Microsoft Excel, Microsoft Excel Viewer, Excel. This CVE ID is unique from CVE-2018-8574.

Published 2018-11-14 01:29:02

Updated 2020-08-24 17:37:01

Source Microsoft Corporation

View at NVD, CVE.org

Vulnerability category: Execute code

Products affected by CVE-2018-8577

Microsoft » Office » Version: 2013 Update SP1
cpe:2.3:a:microsoft:office:2013:sp1:*:*:*:*:*:*
Matching versions
Microsoft » Office » Version: 2010 Update SP2
cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*
Matching versions
Microsoft » Office » Version: 2013 Update SP1 RT Edition
cpe:2.3:a:microsoft:office:2013:sp1:*:*:rt:*:*:*
Matching versions
Microsoft » Office » Version: 2016
cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:*:*
Matching versions
Microsoft » Office » Version: 2016 For Mac Os X
cpe:2.3:a:microsoft:office:2016:*:*:*:*:mac_os_x:*:*
Matching versions
Microsoft » Office » Version: 2019
cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:*:*
Matching versions
Microsoft » Office » Version: 2019 Mac Os X Edition
cpe:2.3:a:microsoft:office:2019:*:*:*:mac_os_x:*:*:*
Matching versions
Microsoft » Excel » Version: 2013 Update SP1
cpe:2.3:a:microsoft:excel:2013:sp1:*:*:*:*:*:*
Matching versions
Microsoft » Excel » Version: 2013 Update SP1 RT Edition
cpe:2.3:a:microsoft:excel:2013:sp1:*:*:rt:*:*:*
Matching versions
Microsoft » Excel » Version: 2016
cpe:2.3:a:microsoft:excel:2016:*:*:*:*:*:*:*
Matching versions
Microsoft » Excel » Version: 2010 Update SP2
cpe:2.3:a:microsoft:excel:2010:sp2:*:*:*:*:*:*
Matching versions
Microsoft » Excel Viewer » Version: 2007 Update SP3
cpe:2.3:a:microsoft:excel_viewer:2007:sp3:*:*:*:*:*:*
Matching versions
Microsoft » Office Compatibility Pack » Version: N/A Update SP3
cpe:2.3:a:microsoft:office_compatibility_pack:-:sp3:*:*:*:*:*:*
Matching versions
Microsoft » Office Web Apps Server » Version: 2013 Update SP1
cpe:2.3:a:microsoft:office_web_apps_server:2013:sp1:*:*:*:*:*:*
Matching versions
Microsoft » Office 365 Proplus » Version: N/A
cpe:2.3:a:microsoft:office_365_proplus:-:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2018-8577

EPSS FAQ

18.35%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 96 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-8577

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C	8.6	10.0	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
7.8	HIGH	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High

References for CVE-2018-8577

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8577

CVE-2018-8577 | Microsoft Excel Remote Code Execution Vulnerability
Patch;Vendor Advisory
http://www.securitytracker.com/id/1042134

Microsoft Excel Flaw Lets Remote Users Execute Arbitrary Code - SecurityTracker
Third Party Advisory;VDB Entry
http://www.securityfocus.com/bid/105834

Microsoft Excel CVE-2018-8577 Remote Code Execution Vulnerability
VDB Entry;Third Party Advisory

Jump to

Vulnerability Details : CVE-2018-8577

Products affected by CVE-2018-8577

Exploit prediction scoring system (EPSS) score for CVE-2018-8577

CVSS scores for CVE-2018-8577

References for CVE-2018-8577