CVE-2018-1011

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Remote Code Execution Vulnerability." This affects Microsoft Excel. This CVE ID is unique from CVE-2018-0920, CVE-2018-1027, CVE-2018-1029.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Microsoft	Microsoft Excel	2010 Service Pack 2 (32-bit editions); 2010 Service Pack 2 (64-bit editions); 2013 RT Service Pack 1; 2013 Service Pack 1 (32-bit editions); 2013 Service Pack 1 (64-bit editions)

References

http://www.securityfocus.com/bid/103611Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040652Third Party Advisory, VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-1011Patch, Vendor Advisory
http://www.securityfocus.com/bid/103611Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040652Third Party Advisory, VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-1011Patch, Vendor Advisory

Timeline

Published: Apr 12, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-101104.8D-Link DIR-615 T1 devices allow XSS via the Add User feature.CVE-2018-101117.5An issue was discovered in GEGL through 0.3.32. The render_rectangle function in process/gegl-processor.c has unbounded memory allocation, l CVE-2018-101128.8An issue was discovered in GEGL through 0.3.32. The gegl_tile_backend_swap_constructed function in buffer/gegl-tile-backend-swap.c allows re CVE-2018-101137.5An issue was discovered in GEGL through 0.3.32. The process function in operations/external/ppm-load.c has unbounded memory allocation, lead CVE-2018-101148.8An issue was discovered in GEGL through 0.3.32. The gegl_buffer_iterate_read_simple function in buffer/gegl-buffer-access.c allows remote at CVE-2018-101157.8Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memory, allowing remote a CVE-2018-101178.8An issue was discovered in idreamsoft iCMS V7.0.7. There is a CSRF vulnerability that can add an admin account via admincp.php?app=members&d CVE-2018-101184.8Monstra CMS 3.0.4 has Stored XSS via the Name field on the Create New Page screen under the admin/index.php?id=pages URI, related to plugins CVE-2018-101197.8sot/source/sdstor/stgstrms.cxx in LibreOffice before 5.4.5.1 and 6.x before 6.0.1.1 uses an incorrect integer data type in the StgSmallStrm CVE-2018-10128.8A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Microso CVE-2018-101207.8The SwCTBWrapper::Read function in sw/source/filter/ww8/ww8toolbar.cxx in LibreOffice before 5.4.6.1 and 6.x before 6.0.2.1 does not validat CVE-2018-101214.8plugins/box/pages/pages.admin.php in Monstra CMS 3.0.4 has a stored XSS vulnerability when an attacker has access to the editor role, and en