High severity · published Jun 14, 2018
CVE-2018-8245
A remote code execution vulnerability exists when Microsoft Publisher fails to utilize features that lock down the Local Machine zone when instantiating OLE objects, aka…
7.8
CVSS
16.5%
EPSS
No
On KEV
Description
A remote code execution vulnerability exists when Microsoft Publisher fails to utilize features that lock down the Local Machine zone when instantiating OLE objects, aka "Microsoft Publisher Remote Code Execution Vulnerability." This affects Microsoft Publisher.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)16.5% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PU
Publisher · Microsoft
2010 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-8245
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-8245
Third Party Advisory
http://www.securityfocus.com/bid/104405
Third Party Advisory
http://www.securitytracker.com/id/1041105
Patch
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8245
More from Publisher
8.8
CVE-2007-0671
Microsoft Office Excel Remote Code Execution Vulnerability
7.3
CVE-2024-38226
Microsoft Publisher Security Feature Bypass Vulnerability
8.8
CVE-2026-81385
Microsoft Office Publisher Remote Code Execution Vulnerability
8.8
CVE-2026-69742
Microsoft Office Publisher Remote Code Execution Vulnerability
8.8
CVE-2020-0760
A remote code execution vulnerability exists when Microsoft Office improperly loads arbitrary type libraries, aka 'Microsoft Office Remote Code Execution Vulnerability'