CVE-2018-0824Microsoft COM for Windows Deserialization of Untrusted Data Vulnerability

A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Microsoft COM for Windows Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

8.8 HIGHEPSS 73.03%⚡ Known Exploited (CISA KEV)NVD: Analyzed

Last updated: 2026-06-17 01:31 UTC

OverviewCVSS details

8.8HIGHCVSS 3.1

Score source: NVD
NVD status: Analyzed
Published: May 9, 2018
Assigner: microsoft

Affected

windows 10 1507 (microsoft)

+12 more products →

Exploitation

Public exploit: Yes · 1 reference
CISA KEV: Listed · Aug 5, 2024
KEV due date: Aug 26, 2024
Ransomware use: Unknown
SSVC: Exploitation active · Automatable no · Impact total

EPSS · FIRST, scored Nov 7

73.03%chance of exploitation in 30 days

Higher than 99.45% of CVEs

CVSS 3.1 · NVD

8.8High

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: Required
Scope: Unchanged
Confidentiality impact: High
Integrity impact: High
Availability impact: High

CVSS 3.1 · CISA-ADP

7.5High

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack vector: Network
Attack complexity: High
Privileges required: None
User interaction: Required
Scope: Unchanged
Confidentiality impact: High
Integrity impact: High
Availability impact: High

CVSS 2.0 · NVD

5.1Medium

AV:N/AC:H/Au:N/C:P/I:P/A:P

Attack vector: Network
Attack complexity: High
Authentication: None
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

NVD status: Analyzed

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
8.8	HIGH	3.1NVD	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
7.5	HIGH	3.1CISA-ADP	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
5.1	MEDIUM	2.0NVD	AV:N/AC:H/Au:N/C:P/I:P/A:P

CISA required action

⚡ Known exploited · remediation due Aug 26, 2024

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Details

CVE ID: CVE-2018-0824
Status: Analyzed
Assigner (CNA): microsoft
Published: May 9, 2018
Last modified: 2026-06-17 01:31 UTC
Weaknesses: CWE-502

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 13:15 UTC.