CVE-2018-0824

State: Published
Severity: 7.5 High
Published: May 9, 2018
Updated: Oct 21, 2025
Reserved: Dec 1, 2017

Description

A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Microsoft COM for Windows Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-502 Deserialization of Untrusted Data

Affected Products

Product	Versions
n/an/a	n/aAffected

References

1040848vdb-entry
44906exploit
104030vdb-entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0824
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0824government-resource

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.