CVE-2018-8628

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory, aka "Microsoft PowerPoint Remote Code Execution Vulnerability." This affects Microsoft Office, Office 365 ProPlus, Microsoft PowerPoint, Microsoft SharePoint, Microsoft PowerPoint Viewer, Office Online Server, Microsoft SharePoint Server.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

VendorProductVersions
MicrosoftMicrosoft Office2016 for Mac; 2019 for 32-bit editions; 2019 for 64-bit editions; 2019 for Mac; Compatibility Pack Service Pack 3; Web Apps 2010 Service Pack 2; Web Apps 2013 Service Pack 1
MicrosoftMicrosoft PowerPoint2010 Service Pack 2 (32-bit editions); 2010 Service Pack 2 (64-bit editions); 2013 RT Service Pack 1; 2013 Service Pack 1 (32-bit editions); 2013 Service Pack 1 (64-bit editions); 2016 (32-bit edition); 2016 (64-bit edition)
MicrosoftMicrosoft SharePointEnterprise Server 2016
MicrosoftMicrosoft PowerPoint ViewerMicrosoft PowerPoint Viewer
MicrosoftOffice365 ProPlus for 32-bit Systems; 365 ProPlus for 64-bit Systems
MicrosoftOffice Online ServerOffice Online Server
MicrosoftMicrosoft SharePoint Server2013 Service Pack 1; 2019

References

Timeline

Published
Dec 12, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-86297.5A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CCVE-2018-86317.5A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory CorCVE-2018-86348.8A remote code execution vulnerability exists in Windows where Microsoft text-to-speech fails to properly handle objects in the memory, aka "CVE-2018-86358.8An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted authenticatioCVE-2018-86367.8A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "CVE-2018-86375.5An information disclosure vulnerability exists in Windows kernel that could allow an attacker to retrieve information that could lead to a KCVE-2018-86385.5An information disclosure vulnerability exists when DirectX improperly handles objects in memory, aka "DirectX Information Disclosure VulnerCVE-2018-86397.8An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k CVE-2018-86417.8An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, akCVE-2018-86437.5A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "ScripCVE-2018-86495.5A denial of service vulnerability exists when Windows improperly handles objects in memory, aka "Windows Denial of Service Vulnerability." TCVE-2018-86505.4A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web reques
CVE-2018-8628: High severity, CVSS 7.8 | Vulnix