What is CVE-2018-8174?

CVE-2018-8174 is a high-severity vulnerability in Microsoft Windows 10, classified under Out-of-bounds Write. CVSS score: 7.5/10. Published 2018-05-09.

How severe is CVE-2018-8174?

High severity. CVSS v3 base score is 7.5 out of 10.

Is CVE-2018-8174 known to be exploited?

Yes. CVE-2018-8174 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2022-02-15), indicating it is being actively exploited. 99 public proof-of-concept repositories are indexed.

Buffer overflow in Microsoft Windows 10

CVE-2018-8174

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1…

Vulnerability class: Buffer Overflow

EPSS: 0.876 (99.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H.

Affected products

Microsoft Windows 10 — versions 32-bit Systems, Version 1607 for 32-bit Systems, Version 1607 for x64-based Systems
Microsoft Windows_10_1607
Microsoft Windows_10_1703
Microsoft Windows_10_1709
Microsoft Windows_10_1803
Microsoft Windows 10 Servers — versions version 1709 (Server Core Installation), version 1803 (Server Core Installation)
Microsoft Windows 7 — versions 32-bit Systems Service Pack 1, x64-based Systems Service Pack 1
Microsoft Windows_7
Microsoft Windows 8.1 — versions 32-bit systems, x64-based systems
Microsoft Windows_8.1

Weakness classification (CWE)

CWE-787 — Out-of-bounds Write

CISA KEV (Known Exploited Vulnerabilities)

This CVE is on the CISA KEV catalog, added on 2022-02-15. CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.

BOD 22-01 due date: 2022-08-15.

Required action: Apply updates per vendor instructions.

Known ransomware campaign use: yes.

Public proof-of-concept exploits

References

secure@microsoft.com (Exploit, VDB Entry, Third Party Advisory, exploit, x_refsource_EXPLOIT-DB)
secure@microsoft.com (Technical Description, Exploit, Third Party Advisory, x_refsource_MISC)
secure@microsoft.com (x_refsource_CONFIRM, Patch, Vendor Advisory)
secure@microsoft.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
134c704f-9b21-4f2e-91b3-4a467353bcc0 (US Government Resource)

Frequently asked questions

What is CVE-2018-8174?: CVE-2018-8174 is a high-severity vulnerability in Microsoft Windows 10, classified under Out-of-bounds Write. CVSS score: 7.5/10. Published 2018-05-09.
How severe is CVE-2018-8174?: High severity. CVSS v3 base score is 7.5 out of 10.
Is CVE-2018-8174 known to be exploited?: Yes. CVE-2018-8174 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2022-02-15), indicating it is being actively exploited. 99 public proof-of-concept repositories are indexed.