Actively exploited · Published May 9, 2018 · Assigned by microsoft
CVE-2018-0824
High 7.5 Exploited
In plain English
A high-severity unsafe deserialization in Windows from Microsoft. Attackers are actively exploiting it in the wild (listed by CISA on August 5, 2024). The chance it is exploited in the next 30 days is estimated at 73.0% (higher than 99.5% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Aug 26, 2024.
Official description
A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Microsoft COM for Windows Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
Affected products (as reported)
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- 1040848 vdb-entry, x_refsource_SECTRACK
- 44906 exploit, x_refsource_EXPLOIT-DB
- 104030 vdb-entry, x_refsource_BID
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0824 x_refsource_CONFIRM
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0824 government-resource