CVE-2018-0824

A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Microsoft COM for Windows Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

Published: May 9, 2018
Updated: Apr 13, 2023
CVE: CVE-2018-0824
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 8.8
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2:

Severity: Medium
Score: 5.1
AV:N/AC:H/Au:N/C:P/I:P/A:P

CWEs:

CWE-502

OWASP TOP 10:

A8 - Insecure Deserialization

Affected Software
References

Software	From	Fixed in
microsoft / windows_server_2008	r2-sp1	r2-sp1.x
microsoft / windows_server_2012	r2	r2.x
microsoft / windows_server_2008	--sp2	--sp2.x
microsoft / windows_7	--sp1	--sp1.x

http://www.securityfocus.com/bid/104030
http://www.securitytracker.com/id/1040848
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0824
https://www.exploit-db.com/exploits/44906/

Vulnerability Database

289,571

CVE-2018-0824