Microsoft Office
CVE-2018-8427 — Microsoft Graphics Components Information Disclosure Vulnerability
Executive Summary
An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory. An attacker who successfully exploited the vulnerability could obtain information that could be useful for further exploitation. To exploit the vulnerability, a user would have to open a specially crafted file. The security update addresses the vulnerability by correcting how Microsoft Graphics Components handle objects in memory.
Overview
4.7
CVSS MEDIUM
Important
MS Severity
Not Exploited
MS Exploit Status
Less Likely
MS Exploit Likelihood
CVSS Vector
ATTACK VECTOR
Local
ATTACK COMPLEXITY
High
PRIVILEGES REQUIRED
Low
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
None
AVAILABILITY
None
EXPLOIT CODE MATURITY
Proof-of-Concept
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 4.2
EPSS Score
No EPSS score available for this CVE.
View on FIRST.orgAffected Products
9 affected products
| Product | KB Article | Severity | Impact | Restart Required |
|---|---|---|---|---|
| Microsoft Excel Viewer 2007 Service Pack 3 | 4092444 (Security Update) |
Important | Information Disclosure | Maybe |
| Microsoft Office 2016 for Mac | Release Notes (Security Update) |
Important | Information Disclosure | No |
| Microsoft Office 2019 for 32-bit editions | Click to Run (Security Update) |
Important | Information Disclosure | No |
| Microsoft Office 2019 for 64-bit editions | Click to Run (Security Update) |
Important | Information Disclosure | No |
| Microsoft Office Compatibility Pack Service Pack 3 | 4092444 (Security Update) |
Important | Information Disclosure | Maybe |
| Microsoft Office Word Viewer | 4092464 (Security Update) |
Important | Information Disclosure | Maybe |
| Microsoft PowerPoint Viewer 2007 | 4092444 (Security Update) |
Important | Information Disclosure | Maybe |
| Office 365 ProPlus for 32-bit Systems | Click to Run (Security Update) |
Important | Information Disclosure | No |
| Office 365 ProPlus for 64-bit Systems | Click to Run (Security Update) |
Important | Information Disclosure | No |
Patches
4 patches
| Article | Type | Restart |
|---|---|---|
4092444 |
Security Update | Maybe |
Release Notes |
Security Update | No |
Click to Run |
Security Update | No |
4092464 |
Security Update | Maybe |
Known Exploits
No known exploits have been linked for this CVE yet. When available, exploit references will be sourced from public repositories and may be unverified, incomplete, or non-functional. Always review code carefully before use in any environment.
Acknowledgments
Lin Wang of Beihang University
References
On This Page