CVE-2018-8412

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An elevation of privilege vulnerability exists when the Microsoft AutoUpdate (MAU) application for Mac improperly validates updates before executing them, aka "Microsoft (MAU) Office Elevation of Privilege Vulnerability." This affects Microsoft Office.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Microsoft	Microsoft Office	2016 for Mac

References

http://www.securityfocus.com/bid/105014Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041484Third Party Advisory, VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8412Patch, Vendor Advisory
http://www.securityfocus.com/bid/105014Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041484Third Party Advisory, VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8412Patch, Vendor Advisory

Timeline

Published: Aug 15, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-84137.8A remote code execution vulnerability exists when "Windows Theme API" does not properly decompress files, aka "Windows Theme API Remote Code CVE-2018-84148.8A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka "Windows Shell Remote Code Ex CVE-2018-84157.8A tampering vulnerability exists in PowerShell that could allow an attacker to execute unlogged code, aka "Microsoft PowerShell Tampering Vu CVE-2018-84166.5A tampering vulnerability exists when .NET Core improperly handles specially crafted files, aka ".NET Core Tampering Vulnerability." This af CVE-2018-84175.3A security feature bypass vulnerability exists in Microsoft JScript that could allow an attacker to bypass Device Guard, aka "Microsoft JScr CVE-2018-84195.5An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address, aka "Windows Kernel In CVE-2018-84208.8A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka "MS XML Remote Code CVE-2018-84219.8A remote code execution vulnerability exists when Microsoft .NET Framework processes untrusted input, aka ".NET Framework Remote Code Execut CVE-2018-84226.5An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows CVE-2018-84237.8A remote code execution vulnerability exists in the Microsoft JET Database Engine, aka "Microsoft JET Database Engine Remote Code Execution CVE-2018-84246.5An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows CVE-2018-84254.3A spoofing vulnerability exists when Microsoft Edge improperly handles specific HTML content, aka "Microsoft Edge Spoofing Vulnerability." T