CVE-2018-0824 kev in the critical feed json
A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Micro…
published 2018-05-09 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-1629
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Exploited
- added 2024-08-05
- epss
- 73.0%
- EPSS 73.0% chance of exploitation in 30 days, percentile 99.4%
- public exploits
- 2
- Metasploit, Exploit-DB
Summary
A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Microsoft COM for Windows Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
Patch / fix
cisa required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Timeline
- Published
- First public exploit (EDB-44906)
- CISA SSVC: exploitation active
- Added to CISA KEV
- CISA patch deadline
Known exploited
- Added
- 2 y ago
- Patch by
- 2024-08-26 (2 y ago)
- Ransomware
- Not known
- Required action
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Vendor, product
- Microsoft, Windows
- CISA name
- Microsoft COM for Windows Deserialization of Untrusted Data Vulnerability
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
73.04% chance of exploitation in the next 30 days, higher than 99.4% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- Metasploit post/windows/escalate/unmarshal_cmd_exec Windows unmarshal post exploitation metasploit post, normal rank, 2018-08-05
- EDB-44906 Microsoft COM for Windows - Privilege Escalation local, 2018-06-18
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 5.1 | AV:N/AC:H/Au:N/C:P/I:P/A:P |
Affected products
- microsoft windows_10
- microsoft windows_7
- microsoft windows_8.1
- microsoft windows_rt_8.1
- microsoft windows_server_2008
- microsoft windows_server_2012
- microsoft windows_server_2016
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
portal.msrc.microsoft.com
/en-US/security-guidance/advisory/CVE-2018-0824
patch, vendor-advisory
-
exploit-db.com
/exploits/44906/
exploit, third-party-advisory, vdb-entry
-
securitytracker.com
/id/1040848
vdb-entry, broken-link, third-party-advisory
-
securityfocus.com
/bid/104030
vdb-entry, broken-link, third-party-advisory
-
cisa.gov
/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0824
government-resource, us-government-resource
Sources
- CVE List CVE-2018-0824
- NVD CVE-2018-0824
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.