CVE-2018-8421

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A remote code execution vulnerability exists when Microsoft .NET Framework processes untrusted input, aka ".NET Framework Remote Code Execution Vulnerability." This affects Microsoft .NET Framework 4.6, Microsoft .NET Framework 3.5, Microsoft .NET Framework 4.7/4.7.1/4.7.2, Microsoft .NET Framework 3.0, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2, Microsoft .NET Framework 4.7.1/4.7.2, Microsoft .NET Framework 4.7.2, Microsoft .NET Framework 2.0.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

VendorProductVersions
MicrosoftMicrosoft .NET Framework2.0 Service Pack 2 on Windows Server 2008 for 32-bit Systems Service Pack 2; 2.0 Service Pack 2 on Windows Server 2008 for Itanium-Based Systems Service Pack 2; 2.0 Service Pack 2 on Windows Server 2008 for x64-based Systems Service Pack 2; 3.0 Service Pack 2 on Windows Server 2008 for 32-bit Systems Service Pack 2; 3.0 Service Pack 2 on Windows Server 2008 for Itanium-Based Systems Service Pack 2; 3.0 Service Pack 2 on Windows Server 2008 for x64-based Systems Service Pack 2; 3.5 on Windows 10 for 32-bit Systems; 3.5 on Windows 10 for x64-based Systems; 3.5 on Windows 10 Version 1607 for 32-bit Systems; 3.5 on Windows 10 Version 1607 for x64-based Systems; 3.5 on Windows 10 Version 1703 for 32-bit Systems; 3.5 on Windows 10 Version 1703 for x64-based Systems; 3.5 on Windows 10 Version 1709 for 32-bit Systems; 3.5 on Windows 10 Version 1709 for x64-based Systems; 3.5 on Windows 10 Version 1803 for 32-bit Systems; 3.5 on Windows 10 Version 1803 for x64-based Systems; 3.5 on Windows 8.1 for 32-bit systems; 3.5 on Windows 8.1 for x64-based systems; 3.5 on Windows Server 2012; 3.5 on Windows Server 2012 (Server Core installation)

References

Timeline

Published
Sep 13, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-84226.5An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows CVE-2018-84237.8A remote code execution vulnerability exists in the Microsoft JET Database Engine, aka "Microsoft JET Database Engine Remote Code Execution CVE-2018-84246.5An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows CVE-2018-84254.3A spoofing vulnerability exists when Microsoft Edge improperly handles specific HTML content, aka "Microsoft Edge Spoofing Vulnerability." TCVE-2018-84265.4A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesCVE-2018-84275.5An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka "Microsoft GraphiCVE-2018-84285.4An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request tCVE-2018-84295.5An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka "Microsoft Excel InCVE-2018-84307.8A remote code execution vulnerability exists in Microsoft Word if a user opens a specially crafted PDF file, aka "Word PDF Remote Code ExecuCVE-2018-84315.4An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request tCVE-2018-84327.8A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka "Microsoft GraphicsCVE-2018-84334.7An information disclosure vulnerability exists when the Windows Graphics component improperly handles objects in memory, aka "Microsoft Grap
CVE-2018-8421: Critical severity, CVSS 9.8 | Vulnix