CVE-2018-8636 is a remote code execution vulnerability in Microsoft Excel, Office 365 ProPlus, and Microsoft Office, stemming from improper handling of objects in memory. With a CVSS score of 7.8 (High), successful exploitation could lead to full compromise of the affected system, requiring user interaction (e.g., opening a malicious file). While no public exploit code is currently available (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community attention and media coverage, including a report of it being actively exploited as a zero-day at the time of its disclosure.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2010CPE matchmatch criteria | cpe:2.3:a:microsoft:excel:2010:sp2:*:*:*:*:*:* | ||
2013CPE matchmatch criteria | cpe:2.3:a:microsoft:excel:2013:sp1:*:*:*:*:*:* | ||
2013CPE matchmatch criteria | cpe:2.3:a:microsoft:excel:2013:sp1:*:*:rt:*:*:* | ||
2016CPE matchmatch criteria | cpe:2.3:a:microsoft:excel:2016:*:*:*:*:*:*:* | ||
2019CPE matchmatch criteria | cpe:2.3:a:microsoft:excel:2019:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.