Vulnerability in Microsoft Expression Blend
CVE-2018-8172
A remote code execution vulnerability exists in Visual Studio software when the software does not check the source markup of a file for an unbuilt project, aka "Visual Studio Remote Code Execution Vulnerability." This affects Microsoft Visual Studio, Expression Blend 4.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.336 (98.4th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 98th percentile — 98.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.328 · newest: 0.336 · change: +0.008
Affected products
- Microsoft Expression Blend — versions 2, 3, 4
- Microsoft Expression Blend 4 — versions Service Pack 3
- Microsoft Visual Studio — versions 2010 Service Pack 1, 2012 Update 5, 2013 Update 5
- Microsoft Visual Studio — versions 2010, 2012, 2013
- Microsoft Visual Studio 2017 — versions 15.7.5
Public proof-of-concept exploits
References
- www.securitytracker.com/id/1041253 (VDB Entry, Third Party Advisory, vdb-entry, Broken Link)
- portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8172 (Patch, Vendor Advisory)
- www.securityfocus.com/bid/104616 (VDB Entry, Third Party Advisory, vdb-entry)
Frequently asked questions
- What is CVE-2018-8172?
- CVE-2018-8172 is a high-severity vulnerability in Microsoft Expression Blend. CVSS score: 7.8/10. Published 2018-07-11.
- How severe is CVE-2018-8172?
- High severity. CVSS v3 base score is 7.8 out of 10.
- Is CVE-2018-8172 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.