CVE-2018-8375 is a remote code execution vulnerability in Microsoft Excel, Excel Viewer, and Office products, stemming from improper handling of objects in memory. This high-severity flaw (CVSS 7.8) requires user interaction (UI:R) and local access (AV:L), but if exploited, could lead to complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H). While not listed in CISA KEV and lacking public exploit code in Metasploit or ExploitDB, it has a high EPSS score and garnered significant community discussion and media coverage at the time of its disclosure in August 2018.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2010CPE matchmatch criteria | cpe:2.3:a:microsoft:excel:2010:sp2:*:*:*:*:*:* | ||
2013CPE matchmatch criteria | cpe:2.3:a:microsoft:excel:2013:*:*:*:*:*:*:* | ||
2013CPE matchmatch criteria | cpe:2.3:a:microsoft:excel:2013:sp1:*:*:*:*:*:* | ||
2016CPE matchmatch criteria | cpe:2.3:a:microsoft:excel:2016:*:*:*:*:*:*:* | ||
2016CPE matchmatch criteria | cpe:2.3:a:microsoft:excel:2016:*:*:*:click-to-run:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.