CVE-2018-1028
Last modified
CVE-2018-1028 is a vulnerability of currently unknown severity. A remote code execution vulnerability exists when the Office graphics component improperly handles specially crafted embedded fonts, aka "Microsoft Office Graphics Remote Code Execution Vulnerability." This affects Word, Microsoft Office, Microsoft SharePoint, Excel, Microsoft SharePoint Server.. EPSS estimates a 19.11% chance of exploitation in the next 30 days.
Description
A remote code execution vulnerability exists when the Office graphics component improperly handles specially crafted embedded fonts, aka "Microsoft Office Graphics Remote Code Execution Vulnerability." This affects Word, Microsoft Office, Microsoft SharePoint, Excel, Microsoft SharePoint Server.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Microsoft | Excel Services | All versions | — |
| Microsoft | Office | 2013 | Sp1 |
| Microsoft | Office | 2013_rt | Sp1 |
| Microsoft | Office | 2016 | — |
| Microsoft | Office 2010 | All versions | Sp2 |
| Microsoft | Office Web Apps | 2010 | Sp2 |
| Microsoft | Office Web Apps | 2013 | Sp1 |
| Microsoft | Sharepoint Enterprise Server | 2013 | Sp1 |
| Microsoft | Sharepoint Enterprise Server | 2016 | — |
| Microsoft | Word Automation Services | All versions | — |
References
- http://www.securityfocus.com/bid/103641Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1040654Third Party Advisory, VDB Entry
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-1028Patch, Vendor Advisory
- http://www.securityfocus.com/bid/103641Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1040654Third Party Advisory, VDB Entry
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-1028Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-1028?
How severe is CVE-2018-1028?
How do I fix CVE-2018-1028?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-10260A Local File Inclusion vulnerability was found in HRSALE The…
- CVE-2018-10265An issue was discovered in HongCMS v3.0.0. There is a CSRF v…
- CVE-2018-10266BEESCMS 4.0 has a CSRF vulnerability to add an administrator…
- CVE-2018-10267WTCMS 1.0 has a CSRF vulnerability to add an administrator a…
- CVE-2018-10268An issue was discovered in FastAdmin V1.0.0.20180417_beta. T…
- CVE-2018-1027A remote code execution vulnerability exists in Microsoft Ex…7.8
- CVE-2018-10283CliqueMania loja virtual 14 has SQL Injection via the patch/…
- CVE-2018-10284Adaltech G-Ticket v70 EME104 has SQL Injection via the mobil…
- CVE-2018-10285The Ericsson-LG iPECS NMS A.1Ac web application uses incorre…
- CVE-2018-10286The Ericsson-LG iPECS NMS A.1Ac web application discloses se…
- CVE-2018-10289In MuPDF 1.13.0, there is an infinite loop in the fz_skip_sp…5.5
- CVE-2018-1029A remote code execution vulnerability exists in Microsoft Ex…7.8
Are you affected by CVE-2018-1028?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST