CVE-2018-8587: microsoft microsoft office
CVSS: 9.3v2.0HighModified
Published 12-12-2018Last modified 05-08-2024
Vulnerability summary
CVE-2018-8587 is a high (CVSS 9.3) vulnerability in microsoft microsoft office. EPSS estimates a 28.78% chance of exploitation in the next 30 days, higher than 98.1% of scored vulnerabilities.
CVSS score
9.3/10
010
High · v2.0 (NVD)EPSS score
28.78%
0%100%
High · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 12-12-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka "Microsoft Outlook Remote Code Execution Vulnerability." This affects Office 365 ProPlus, Microsoft Office, Microsoft Outlook.
CVSS metrics
2 scores · 1 source · 2 versionsHigh 7.8Preferred score · NVD (NIST)
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSourcesSingle source
High 9.3Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:C/I:C/A:CSourcesSingle source
EPSS trend
Probability
28.78%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
0.00 pp
From 28.78% on 18-09-2026
18-09-202618-10-2026
EPSS score28.78%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Microsoft4 products
- microsoft office2019 for 32-bit editions | 2019 for 64-bit editions
- microsoft outlook2010 Service Pack 2 (32-bit editions) | 2010 Service Pack 2 (64-bit editions) | 2013 RT Service Pack 1 | 2013 Service Pack 1 (32-bit editions) | 2013 Service Pack 1 (64-bit editions) | 2016 (32-bit edition) | 2016 (64-bit edition)
- officeEOL365 ProPlus for 32-bit Systems | 365 ProPlus for 64-bit Systems | 2010:sp2 | 2013:sp1 | 2016 | 2019
- office_365_proplusna
1 vendor · 4 products
References
2 links- portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8587X Refsource CONFIRMPatchVendor Advisory