CVE-2018-0920 is a remote code execution vulnerability in Microsoft Excel, where improper handling of objects in memory can lead to arbitrary code execution. With a CVSS score of 7.8 (High), successful exploitation requires user interaction (UI:R) and local access (AV:L), but can result in high impact to confidentiality, integrity, and availability (C:H/I:H/A:H). While not actively exploited in the wild (KEV: No), its high EPSS score and FAUCET Risk Score of 95/100 indicate significant potential risk. There are no known public exploits or Metasploit modules, but the vulnerability has received some community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2010CPE matchmatch criteria | cpe:2.3:a:microsoft:excel:2010:sp2:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.