CVE-2018-0950: microsoft microsoft office
Vulnerability summary
CVE-2018-0950 is a medium (CVSS 6.5) vulnerability in microsoft microsoft office. EPSS estimates a 8.93% chance of exploitation in the next 30 days, higher than 95.2% of scored vulnerabilities.
Timeline
- 12-04-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
An information disclosure vulnerability exists when Office renders Rich Text Format (RTF) email messages containing OLE objects when a message is opened or previewed, aka "Microsoft Office Information Disclosure Vulnerability." This affects Microsoft Word, Microsoft Office. This CVE ID is unique from CVE-2018-1007.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
8.93%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
-0.17 pp
From 9.10% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Microsoft5 products
- microsoft office2010 Service Pack 2 (32-bit editions) | 2010 Service Pack 2 (64-bit editions) | 2016 Click-to-Run (C2R) for 32-bit editions | 2016 Click-to-Run (C2R) for 64-bit editions | Compatibility Pack Service Pack 3
- microsoft word2007 Service Pack 3 | 2010 Service Pack 2 (32-bit editions) | 2010 Service Pack 2 (64-bit editions) | 2013 RT Service Pack 1 | 2013 Service Pack 1 (32-bit editions) | 2013 Service Pack 1 (64-bit editions) | 2016 (32-bit edition) | 2016 (64-bit edition)
- officeEOL2010:sp2 | 2016
- office_compatibility_packna
- word2007:sp3 | 2010:sp2 | 2013:sp1 | 2016
1 vendor · 5 products
References
3 links
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0950X Refsource CONFIRMPatchVendor Advisory