8.8

CVE-2018-0824: Microsoft COM for Windows Deserialization of Untrusted Data Vulnerability

CVSS: 8.8v3.1HighKEVAnalyzed
Published 09-05-2018Last modified 21-10-2025
Open JSON

Vulnerability summary

CVE-2018-0824 is a high (CVSS 8.8) Deserialization of Untrusted Data vulnerability in Microsoft Windows. It is known to be exploited: CISA lists it, first on 05-08-2024. EPSS estimates a 73.04% chance of exploitation in the next 30 days, higher than 99.4% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk
85/100
0100
Critical · default modelHow is this calculated?
CVSS score
8.8/10
010
High · v3.1 (NVD)
EPSS score
73.04%
0%100%
Critical · -0.15 pp in 30 days
KEVListedCISA
RansomwareNone recordedNo known use recorded
Public exploits2exploit-database, metasploit

Timeline

  1. 09-05-2018
    PublishedVulnerability first disclosed.
  2. 05-08-2024
    Added to CISA KEVMicrosoft COM for Windows Deserialization of Untrusted Data Vulnerability
  3. 26-08-2024
    CISA remediation dueApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
  4. 21-10-2025
    Last modifiedVulnerability information updated.

Description

A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Microsoft COM for Windows Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

CVSS metrics

3 scores · 2 sources · 2 versions

EPSS trend

Probability

73.04%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

-0.15 pp

From 73.19% on 18-09-2026

18-09-202618-10-2026
EPSS score
73.04%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
05-08-2024
Federal due date
26-08-2024

CISA required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. msrc.microsoft.com/update-guide/en-US/advisory/CVE-2018-0824 nvd.nist.gov/vuln/detail/CVE-2018-0824

Public exploits

2 found
  • exploit-databaselocalwindowsUnverified

    Microsoft COM for Windows - Privilege Escalation

    Maturity: poc

  • MetasploitMetasploitlocalUnverified

    Windows unmarshal post exploitation

    post/windows/escalate/unmarshal_cmd_exec

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Microsoft13 products

1 vendor · 13 products

References

5 links