CVEvulnerability
CVE-2018-1028
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2018-04-12
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 8.8 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-94
Description
A remote code execution vulnerability exists when the Office graphics component improperly handles specially crafted embedded fonts, aka "Microsoft Office Graphics Remote Code Execution Vulnerability." This affects Word, Microsoft Office, Microsoft SharePoint, Excel, Microsoft SharePoint Server.
Affected configurations
• microsoft excel services
• microsoft office 2013
• microsoft office 2013 rt
• microsoft office 2016
• microsoft office 2010
• microsoft office web apps 2010
• microsoft office web apps 2013
• microsoft sharepoint enterprise server 2013
• microsoft sharepoint enterprise server 2016
• microsoft word automation services
Related
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- http://www.securityfocus.com/bid/103641 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1040654 Third Party Advisory, VDB Entry
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-1028 Patch, Vendor Advisory
- http://www.securityfocus.com/bid/103641 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1040654 Third Party Advisory, VDB Entry
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-1028 Patch, Vendor Advisory