Main Vulnerability Database Vulnerabilities #VU15254

Improper input validation in Microsoft Windows and Windows Server - CVE-2018-8495

Published: October 9, 2018 / Updated: October 12, 2018

Vulnerability identifier: #VU15254

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-8495

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker can execute arbitrary code on the target system.

The weakness exists due to improper handling of URIs by Windows Shell. A remote attacker can trick the victim into opening a specially crafted file with Microsoft Edge and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

Affected software

Microsoft Windows
Windows Server

How to mitigate CVE-2018-8495

Install updates from vendor's website.

External References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8495

Related Security Bulletins