CVE-2018-0851CWE-787

CVE-2018-0851

High · published February 15, 2018

CVSS v3.0
8.8
EPSS
19%
Percentile
97.3
In the wild
Unconfirmed
What it is

Microsoft Office 2007 SP2, Microsoft Office Word Viewer, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1 and RT SP1, Microsoft Office 2016, and Microsoft Office 2016 Click-to-Run (C2R) allow a remote code execution vulnerability, due to how Office handles objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE is unique from CVE-2018-0852.

The record
Technical detail
CVSS v3.0
8.8 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.19111 · 97.3th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2018-02-15T07:29Z
Affected products (8)
ProductVersionsFixed in
microsoft/officeall versions—
microsoft/officeall versions—
microsoft/officeall versions—
microsoft/office_word_viewerall versions—
microsoft/outlookall versions—
microsoft/outlookall versions—
microsoft/outlookall versions—
microsoft/outlookall versions—
References (6)
http://www.securityfocus.com/bid/102870 · [email protected]http://www.securitytracker.com/id/1040381 · [email protected]https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0851 · [email protected]http://www.securityfocus.com/bid/102870 · af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1040381 · af854a3a-2127-422b-91ae-364da2661108https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0851 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 15 FEB 02:00Z
    Microsoft Office 2007 SP2, Microsoft Office Word Viewer, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1 and RT SP1, Microsoft Office 2016, and Microsoft…
    cvelistv5