Memory corruption in Microsoft Outlook and Microsoft Office - CVE-2018-0793

Vulnerability identifier: #VU9912

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-0793

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists in Microsoft Office software due to improper handling of objects in memory. A remote attacker can trick the victim into opening a specially crafted file, trigger memory corruption and execute arbitrary code with system privileges.

Successful exploitation of the vulnerability may result in system compromise.

Microsoft Outlook
Microsoft Office

Install update from vendor's website.

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0793

• Remote code execution in Microsoft Outlook
• Multiple vulnerabilities in Microsoft Word