IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key
7.5High KEV

CVE-2018-0824Microsoft COM for Windows Deserialization of Untrusted Data Vulnerability

microsoft windows_10; microsoft windows_7; microsoft windows_8.1; microsoft windows_rt_8.1 Published: (8 years ago)

Known exploited — Microsoft COM for Windows Deserialization of Untrusted Data Vulnerability

CISA confirmed this vulnerability is used in real attacks on 05.08.2024. Remediation deadline for US federal agencies: 26.08.2024.

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2018-0824; https://nvd.nist.gov/vuln/detail/CVE-2018-0824

Description

A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Microsoft COM for Windows Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

Weakness (CWE): CWE-502

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

VendorProductVersions
microsoft windows_10 1607
microsoft windows 10 1507 —
microsoft windows 10 1607 —
microsoft windows 10 1703 —
microsoft windows 10 1709 —
microsoft windows 10 1803 —
microsoft windows_7 0
microsoft windows_8.1 0
microsoft windows_rt_8.1 0
microsoft windows server 1709 —
microsoft windows server 1803 —
microsoft windows_server_2008 r2
microsoft windows_server_2012 0
microsoft windows_server_2016 1709

References and patches

CPE matches (NVD) (16)
  • cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_1709:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_1803:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*
  • cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*
  • cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*

Recent CVEs in the same product — Windows 10

7.0High
CVE-2026-108135

Windows Backup Engine Elevation of Privilege Vulnerability

Microsoft Windows 10 Version 21H2; Microsoft Windows 10 Version 22H2; Microsoft Windows 11 version 23H2; Microsoft Windows 11 Version 23H2

Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.

6.5Medium
CVE-2026-108129

Role: DNS Server Information Disclosure Vulnerability

Microsoft Windows 10 Version 1607; Microsoft Windows 10 Version 1809; Microsoft Windows 10 Version 21H2; Microsoft Windows 10 Version 22H2

Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.

1.1%EPSS