CVE-2018-8265

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A remote code execution vulnerability exists in the way Microsoft Exchange software parses specially crafted email messages, aka "Microsoft Exchange Remote Code Execution Vulnerability." This affects Microsoft Exchange Server.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Microsoft	Microsoft Exchange Server	2013 Cumulative Update 21; 2016 Cumulative Update 10

References

http://www.securityfocus.com/bid/105491Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041836Third Party Advisory, VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8265Patch, Vendor Advisory
http://www.securityfocus.com/bid/105491Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041836Third Party Advisory, VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8265Patch, Vendor Advisory

Timeline

Published: Oct 10, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-82667.5A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C CVE-2018-82677.5A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scrip CVE-2018-82697.5A denial of service vulnerability exists when OData Library improperly handles web requests, aka "OData Denial of Service Vulnerability." Th CVE-2018-82715.5An information disclosure vulnerability exists in Windows when the Windows bowser.sys kernel-mode driver fails to properly handle objects in CVE-2018-82739.8A buffer overflow vulnerability exists in the Microsoft SQL Server that could allow remote code execution on an affected system, aka "Micros CVE-2018-82747.5A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruptio CVE-2018-82757.5A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruptio CVE-2018-82766.5A security feature bypass vulnerability exists in the Microsoft Chakra scripting engine that allows Control Flow Guard (CFG) to be bypassed,CVE-2018-82786.1A spoofing vulnerability exists when Microsoft Edge improperly handles specific HTML content, aka "Microsoft Edge Spoofing Vulnerability." T CVE-2018-82797.5A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruptio CVE-2018-82807.5A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C CVE-2018-82817.8A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka