CVE-2018-8432 Memory corruption in Microsoft Excel Viewer

What is CVE-2018-8432?

CVE-2018-8432 is a high-severity memory corruption vulnerability in Microsoft Excel Viewer, published on 10 Oct 2018. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka "Microsoft Graphics Components Remote Code Execution Vulnerability." This affects Windows 7, Microsoft Office, Microsoft Office Word Viewer, Office 365 ProPlus, Microsoft Excel Viewer, Microsoft PowerPoint Viewer, Windows Server 2019, Windows Server 2008 R2, Windows 10, Windows Server 2008.

Which versions are affected by CVE-2018-8432?

It affects 10 products.

Products include Microsoft Excel Viewer, Microsoft Office, Microsoft Office 365 Proplus, Microsoft Office Compatibility Pack, Microsoft Powerpoint Viewer, Microsoft Windows 10 and 4 more.

How do I fix CVE-2018-8432?

No fix has been published for CVE-2018-8432 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2018-8432 being exploited?

There is no known exploitation of CVE-2018-8432 in the wild and no public exploit code.

Other vulnerabilities in Microsoft Excel Viewer

• CVE-2019-0541 Microsoft MSHTML Remote Code Execution Exploited High 8.8
• CVE-2015-2424 Microsoft PowerPoint Memory Corruption Exploited High 8.8
• CVE-2013-3906 Microsoft Graphics Component Memory Corruption Exploited High 7.8
• CVE-2008-0113 Memory corruption in n/a Critical 9.3
• CVE-2019-0540 Security feature bypass in Microsoft Excel Viewer Medium 5.5

All Microsoft Excel Viewer vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-w9fx-69v3-2jgx.