{"schemaVersion":3,"id":"CVE-2018-8151","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"An information disclosure vulnerability exists when Microsoft Exchange improperly handles objects in memory, aka \"Microsoft Exchange Memory Corruption Vulnerability.\" This affects Microsoft Exchange Server. This CVE ID is unique from CVE-2018-8154.","dates":{"published":"2018-05-09T19:00:00.000Z","modified":"2024-08-05T06:46:13.516Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":4.3,"severity":"medium","version":"3.0","versionLabel":"v3.0","source":"NVD","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.0","versionLabel":"v3.0","source":"NVD","score":4.3,"severity":"medium","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":4.3,"severity":"medium","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.08697,"percentile":0.95091,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":-0.16199999999999964,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.08859},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.08769,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.09525,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.08697,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.08697,"percentile":0.95091}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.09525,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.08859,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.08697,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.08697,"percentile":0.95091}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer","description":"The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/119.html"}],"affected":[{"vendor":"microsoft","product":"exchange_server","name":"exchange server","label":"exchange_server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2010:sp3","noFixRecorded":false,"fixedIn":null},{"text":"2013:cumulative_update_19","noFixRecorded":false,"fixedIn":null},{"text":"2013:cumulative_update_20","noFixRecorded":false,"fixedIn":null},{"text":"2013:sp1","noFixRecorded":false,"fixedIn":null},{"text":"2016:cumulative_update_8","noFixRecorded":false,"fixedIn":null},{"text":"2016:cumulative_update_9","noFixRecorded":false,"fixedIn":null}],"versionsText":"2010:sp3 | 2013:cumulative_update_19 | 2013:cumulative_update_20 | 2013:sp1 | 2016:cumulative_update_8 | 2016:cumulative_update_9","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"msexchange","label":"Microsoft Exchange","category":"server-app"}},"hubHref":"/vendor/microsoft/exchange_server"},{"vendor":"microsoft","product":"microsoft exchange server","name":"Microsoft Exchange Server","label":"microsoft exchange server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2010 Service Pack 3 Update Rollup 21","noFixRecorded":false,"fixedIn":null},{"text":"2013 Cumulative Update 19","noFixRecorded":false,"fixedIn":null},{"text":"2013 Cumulative Update 20","noFixRecorded":false,"fixedIn":null},{"text":"2013 Service Pack 1","noFixRecorded":false,"fixedIn":null},{"text":"2016 Cumulative Update 8","noFixRecorded":false,"fixedIn":null},{"text":"2016 Cumulative Update 9","noFixRecorded":false,"fixedIn":null}],"versionsText":"2010 Service Pack 3 Update Rollup 21 | 2013 Cumulative Update 19 | 2013 Cumulative Update 20 | 2013 Service Pack 1 | 2016 Cumulative Update 8 | 2016 Cumulative Update 9","eol":null,"hubHref":"/vendor/microsoft/microsoft_exchange_server"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://www.securityfocus.com/bid/104042","label":"www.securityfocus.com/bid/104042","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Third Party Advisory"]},{"url":"http://www.securitytracker.com/id/1040850","label":"www.securitytracker.com/id/1040850","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Third Party Advisory"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8151","label":"portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8151","hostname":"portal.msrc.microsoft.com","tags":["X Refsource CONFIRM","Patch","Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2018-05-09T19:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-05T06:46:13.516Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":19,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T19:16:21.875Z","stale":false,"partial":false}}