CVEvulnerability
CVE-2018-8174
CISA Known Exploited Vulnerability
Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability — Microsoft Windows
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution"
- Added to KEV
- 2022-02-15
- Remediation due
- 2022-08-15
- Ransomware use
- Known
- Required action
- Apply updates per vendor instructions.
- Notes
- https://nvd.nist.gov/vuln/detail/CVE-2018-8174
- Status
- Analyzed
- Published
- 2018-05-09
- Last modified
- 2026-08-13
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 7.5 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.6 HIGH — AV:N/AC:H/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-787
Description
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
Affected configurations
• microsoft windows 10 1607
• microsoft windows 10 1703
• microsoft windows 10 1709
• microsoft windows 10 1803
• microsoft windows 7
• microsoft windows 8.1
• microsoft windows rt 8.1
• microsoft windows server 2008
• microsoft windows server 2008 r2
• microsoft windows server 2012
• microsoft windows server 2012 r2
• microsoft windows server 2016
Related
Weakness · CWE (1)
- CWE-787 Out-of-bounds Write weakness
Referenced by CWE · observed example (1)
- CWE-1265 Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls weakness
References
- http://www.securityfocus.com/bid/103998 Third Party Advisory, VDB Entry
- https://blog.0patch.com/2018/05/a-single-instruction-micropatch-for.html Exploit, Technical Description, Third Party Advisory
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8174 Patch, Vendor Advisory
- https://www.exploit-db.com/exploits/44741/ Exploit, Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/103998 Third Party Advisory, VDB Entry
- https://blog.0patch.com/2018/05/a-single-instruction-micropatch-for.html Exploit, Technical Description, Third Party Advisory
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8174 Patch, Vendor Advisory
- https://www.exploit-db.com/exploits/44741/ Exploit, Third Party Advisory, VDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8174 US Government Resource