#VU12077 Memory corruption in Microsoft products - CVE-2018-8174

Vulnerability identifier: #VU12077

Vulnerability risk: Critical

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red

CVE-ID: CVE-2018-8174

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

Vulnerable software:
Windows
Windows Server
Windows Live Messenger

Software vendor:
Microsoft

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the VBScript engine. A remote attacker can trick the victim into visiting a specially crafted website or open a malicious Office file and execute arbitrary code on the target system.

Note: the vulnerability is being actively exploited in the wild against victims in Asia region. The vulnerability is dubbed "double play".

Install updates from vendor's website.

• https://twitter.com/360CoreSec/status/987229032994361345
• https://www.eshlomo.us/apt-group-exploited-unpatched-0-day-in-ie/
• https://www.bleepingcomputer.com/news/security/internet-explorer-zero-day-exploited-in-the-wild-by-a...
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8174