CVE-2018-8174: high-severity vulnerability in Microsoft Windows 7
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA, has a public proof of concept and 2 threat group(s) use it.
Groups known to exploit this vulnerability (MITRE ATT&CK attribution).
Apply updates per vendor instructions.
A flaw in Windows VBScript engine allows attackers to run malicious code remotely by exploiting how the engine handles objects in memory. This can lead to complete system compromise if a user visits a malicious website or opens a crafted document.
Out-of-bounds write vulnerability (CWE-787) in VBScript engine allows remote code execution via specially crafted objects. Attack vector is network-based; user interaction required (visiting malicious site or opening document). Impacts confidentiality, integrity, and availability across multiple Windows versions.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.