An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading…

published 2018-08-15 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-19990

cvss: 7.0; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.2%; EPSS 1.2% chance of exploitation in 30 days, percentile 67%
public exploits: 0; none known

An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior, aka "Windows Installer Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

Exploit prediction

1.16% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	3.0	7.0	CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	6.9	AV:L/AC:M/Au:N/C:C/I:C/A:C

Affected products

Microsoft Windows 7
Microsoft Windows Server 2012 R2
Microsoft Windows RT 8.1
Microsoft Windows Server 2008
Microsoft Windows Server 2012
Microsoft Windows 8.1
Microsoft Windows Server 2016
Microsoft Windows Server 2008 R2
Microsoft Windows 10
Microsoft Windows 10 Servers

Classification

Weakness

CWE-20 Improper Input Validation

References

portal.msrc.microsoft.com /en-US/security-guidance/advisory/CVE-2018-8339
vendor-advisory
securityfocus.com /bid/105030
vdb-entry, third-party-advisory
securitytracker.com /id/1041466
vdb-entry, third-party-advisory

Sources

CVE List CVE-2018-8339
NVD CVE-2018-8339

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary