IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
7.5Hoch KEV

CVE-2018-0824Microsoft COM for Windows Deserialization of Untrusted Data Vulnerability

microsoft windows_10; microsoft windows_7; microsoft windows_8.1; microsoft windows_rt_8.1 Veröffentlicht: (vor 8 Jahren)

Bekannt ausgenutzt — Microsoft COM for Windows Deserialization of Untrusted Data Vulnerability

CISA hat am 05.08.2024 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 26.08.2024.

Erforderliche Maßnahme: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2018-0824; https://nvd.nist.gov/vuln/detail/CVE-2018-0824

Beschreibung

A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Microsoft COM for Windows Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

Schwachstellentyp (CWE): CWE-502

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
microsoft windows_10 1607
microsoft windows 10 1507 —
microsoft windows 10 1607 —
microsoft windows 10 1703 —
microsoft windows 10 1709 —
microsoft windows 10 1803 —
microsoft windows_7 0
microsoft windows_8.1 0
microsoft windows_rt_8.1 0
microsoft windows server 1709 —
microsoft windows server 1803 —
microsoft windows_server_2008 r2
microsoft windows_server_2012 0
microsoft windows_server_2016 1709

Referenzen und Patches

CPE-Treffer (NVD) (16)
  • cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_1709:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_1803:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*
  • cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*
  • cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*

Neue CVEs im selben Produkt — Windows 10

7.0Hoch
CVE-2026-108135

Windows Backup Engine Elevation of Privilege Vulnerability

Microsoft Windows 10 Version 21H2; Microsoft Windows 10 Version 22H2; Microsoft Windows 11 version 23H2; Microsoft Windows 11 Version 23H2

Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.

6.5Mittel
CVE-2026-108129

Role: DNS Server Information Disclosure Vulnerability

Microsoft Windows 10 Version 1607; Microsoft Windows 10 Version 1809; Microsoft Windows 10 Version 21H2; Microsoft Windows 10 Version 22H2

Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.

1.1%EPSS