CVE-2018-0824highunder attackCWE-502

CVE-2018-0824

Published · Updated

Follow this CVE+ Monitor Windows

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 7.5epss 73%
from disclosure to weapon37 days
Published on NVDMay 9
1st PoC+37d
metasploit+88d
CISA KEV+2280d
Action required by CISAfederal deadline: 2024-08-26

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

Microsoft COM fails to safely handle serialized objects, allowing attackers to execute arbitrary code remotely on affected Windows systems. This is a critical flaw because it requires no user interaction beyond receiving malicious data.

Technical detail

CWE-502 unsafe deserialization vulnerability in Microsoft COM allows remote code execution when specially crafted serialized objects are processed without proper validation. The attack vector is network-based with low complexity; no authentication or user interaction is required. Impact includes complete system compromise across multiple Windows versions.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Microsoft COM for Windows Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.