CVE-2018-8552 in the critical feed json
An information disclosure vulnerability exists when VBScript improperly discloses the contents of its memory, which could provide an attack…
published 2018-11-14 7 y ago modified 2026-06-17 4 mo ago also EUVD-2018-20172
- cvss
- 7.5
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 51.0%
- EPSS 51.0% chance of exploitation in 30 days, percentile 98%
- public exploits
- 1
- Exploit-DB
Summary
An information disclosure vulnerability exists when VBScript improperly discloses the contents of its memory, which could provide an attacker with information to further compromise the user's computer or data, aka "Windows Scripting Engine Memory Corruption Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10.
Patch / fix
Timeline
- Published
- First public exploit (EDB-45924)
Exploit prediction
50.96% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- EDB-45924 VBScript - 'rtFilter' Out-of-Bounds Read dos, 2018-11-30
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.6 | AV:N/AC:H/Au:N/C:C/I:C/A:C |
Affected products
- Microsoft Internet Explorer 9
- Microsoft Internet Explorer 11
- Microsoft Internet Explorer 10
Classification
- Weakness
-
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
References
-
portal.msrc.microsoft.com
/en-US/security-guidance/advisory/CVE-2018-8552
patch, vendor-advisory
-
exploit-db.com
/exploits/45924/
exploit, third-party-advisory, vdb-entry
-
securityfocus.com
/bid/105786
vdb-entry, third-party-advisory
Sources
- CVE List CVE-2018-8552
- NVD CVE-2018-8552
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.