CVE-2018-8403 — A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka "Microsoft Browser Memory Corruption Vulnerability." This affects Internet Explorer 11, Microsoft Edge, Internet Explorer 10

Back Back to CVE browser

HIGH

A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka "Microsoft Browser Memory Corruption Vulnerability." This affects Internet Explorer 11, Microsoft Edge, Internet Explorer 10

Published Aug 15, 2018

7.5

HIGH

CVSS 3.0

EPSS 12.55%

Description

A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka "Microsoft Browser Memory Corruption Vulnerability." This affects Internet Explorer 11, Microsoft Edge, Internet Explorer 10.

Affected products

Vendor Microsoft Product Internet Explorer 10 Default
n/a
- Version
  Windows Server 2012
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Internet Explorer 11 Default
n/a
- Version
  Windows 10 Version 1607 for 32-bit Systems
  Status
  affected
  Constraints
  -
- Version
  Windows 10 Version 1607 for x64-based Systems
  Status
  affected
  Constraints
  -
- Version
  Windows 10 Version 1703 for 32-bit Systems
  Status
  affected
  Constraints
  -
- Version
  Windows 10 Version 1703 for x64-based Systems
  Status
  affected
  Constraints
  -
- Version
  Windows 10 Version 1709 for 32-bit Systems
  Status
  affected
  Constraints
  -
- Version
  Windows 10 Version 1709 for x64-based Systems
  Status
  affected
  Constraints
  -
- Version
  Windows 10 Version 1803 for 32-bit Systems
  Status
  affected
  Constraints
  -
- Version
  Windows 10 Version 1803 for x64-based Systems
  Status
  affected
  Constraints
  -
- Version
  Windows 10 for 32-bit Systems
  Status
  affected
  Constraints
  -
- Version
  Windows 10 for x64-based Systems
  Status
  affected
  Constraints
  -
- Version
  Windows 7 for 32-bit Systems Service Pack 1
  Status
  affected
  Constraints
  -
- Version
  Windows 7 for x64-based Systems Service Pack 1
  Status
  affected
  Constraints
  -
- Version
  Windows 8.1 for 32-bit systems
  Status
  affected
  Constraints
  -
- Version
  Windows 8.1 for x64-based systems
  Status
  affected
  Constraints
  -
- Version
  Windows RT 8.1
  Status
  affected
  Constraints
  -
- Version
  Windows Server 2008 R2 for x64-based Systems Service Pack 1
  Status
  affected
  Constraints
  -
- Version
  Windows Server 2012 R2
  Status
  affected
  Constraints
  -
- Version
  Windows Server 2016
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Microsoft Edge Default
n/a
- Version
  Windows 10 Version 1607 for 32-bit Systems
  Status
  affected
  Constraints
  -
- Version
  Windows 10 Version 1607 for x64-based Systems
  Status
  affected
  Constraints
  -
- Version
  Windows 10 Version 1703 for 32-bit Systems
  Status
  affected
  Constraints
  -
- Version
  Windows 10 Version 1703 for x64-based Systems
  Status
  affected
  Constraints
  -
- Version
  Windows 10 for 32-bit Systems
  Status
  affected
  Constraints
  -
- Version
  Windows 10 for x64-based Systems
  Status
  affected
  Constraints
  -
- Version
  Windows Server 2016
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Microsoft

Internet Explorer 10

n/a

Version	Status	Constraints
Windows Server 2012	affected	-

Microsoft

Internet Explorer 11

n/a

Version	Status	Constraints
Windows 10 Version 1607 for 32-bit Systems	affected	-
Windows 10 Version 1607 for x64-based Systems	affected	-
Windows 10 Version 1703 for 32-bit Systems	affected	-
Windows 10 Version 1703 for x64-based Systems	affected	-
Windows 10 Version 1709 for 32-bit Systems	affected	-
Windows 10 Version 1709 for x64-based Systems	affected	-
Windows 10 Version 1803 for 32-bit Systems	affected	-
Windows 10 Version 1803 for x64-based Systems	affected	-
Windows 10 for 32-bit Systems	affected	-
Windows 10 for x64-based Systems	affected	-
Windows 7 for 32-bit Systems Service Pack 1	affected	-
Windows 7 for x64-based Systems Service Pack 1	affected	-
Windows 8.1 for 32-bit systems	affected	-
Windows 8.1 for x64-based systems	affected	-
Windows RT 8.1	affected	-
Windows Server 2008 R2 for x64-based Systems Service Pack 1	affected	-
Windows Server 2012 R2	affected	-
Windows Server 2016	affected	-

Microsoft

Microsoft Edge

n/a

Version	Status	Constraints
Windows 10 Version 1607 for 32-bit Systems	affected	-
Windows 10 Version 1607 for x64-based Systems	affected	-
Windows 10 Version 1703 for 32-bit Systems	affected	-
Windows 10 Version 1703 for x64-based Systems	affected	-
Windows 10 for 32-bit Systems	affected	-
Windows 10 for x64-based Systems	affected	-
Windows Server 2016	affected	-

Remediation

No remediation recorded yet.

Metrics

12.55% 0.12555

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.12555

Score over time

2021–2026

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (37 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	12.55% (0.12555)	96.12th	v5 (v2026.06.15)
Jun 15, 2026	12.55% (0.12555)	95.71th	v5 (v2026.06.15)
Jan 3, 2026	19.95% (0.19945)	95.31th	v4 (v2025.03.14)
Dec 7, 2025	15.60% (0.15604)	94.42th	v4 (v2025.03.14)
Aug 9, 2025	9.86% (0.09861)	92.67th	v4 (v2025.03.14)
Mar 30, 2025	5.99% (0.05988)	89.73th	v4 (v2025.03.14)
Mar 29, 2025	63.66% (0.63662)	97.77th	v4 (v2025.03.14)
Mar 19, 2025	5.03% (0.05033)	88.47th	v4 (v2025.03.14)
Mar 17, 2025	11.15% (0.11150)	92.95th	v4 (v2025.03.14)
Feb 8, 2025	52.01% (0.52010)	97.73th	v3 (v2023.03.01)
Dec 17, 2024	59.47% (0.59471)	97.88th	v3 (v2023.03.01)
Dec 12, 2024	6.14% (0.06136)	93.81th	v3 (v2023.03.01)
Jun 24, 2024	6.35% (0.06352)	93.69th	v3 (v2023.03.01)
May 30, 2024	6.38% (0.06383)	93.64th	v3 (v2023.03.01)
Apr 30, 2024	5.80% (0.05796)	93.30th	v3 (v2023.03.01)
Apr 3, 2024	5.71% (0.05708)	93.20th	v3 (v2023.03.01)
Jan 27, 2024	5.06% (0.05064)	92.15th	v3 (v2023.03.01)
Jan 6, 2024	3.91% (0.03910)	91.09th	v3 (v2023.03.01)
Nov 24, 2023	4.37% (0.04371)	91.45th	v3 (v2023.03.01)
Aug 9, 2023	3.89% (0.03891)	90.77th	v3 (v2023.03.01)
Jun 5, 2023	3.86% (0.03860)	90.61th	v3 (v2023.03.01)
Mar 31, 2023	3.56% (0.03556)	90.18th	v3 (v2023.03.01)
Mar 11, 2023	3.82% (0.03817)	90.48th	v3 (v2023.03.01)
Mar 7, 2023	3.42% (0.03419)	89.96th	v3 (v2023.03.01)
Mar 6, 2023	33.43% (0.33428)	97.66th	v2 (v2022.01.01)
Dec 6, 2022	33.43% (0.33428)	97.61th	v2 (v2022.01.01)
Sep 15, 2022	31.29% (0.31286)	97.47th	v2 (v2022.01.01)
Aug 1, 2022	30.00% (0.29997)	97.39th	v2 (v2022.01.01)
Jun 28, 2022	26.12% (0.26119)	96.96th	v2 (v2022.01.01)
May 22, 2022	22.18% (0.22185)	96.37th	v2 (v2022.01.01)
Apr 1, 2022	20.50% (0.20497)	96.15th	v2 (v2022.01.01)
Feb 9, 2022	20.50% (0.20497)	94.05th	v2 (v2022.01.01)
Feb 4, 2022	16.54% (0.16536)	92.90th	v2 (v2022.01.01)
Feb 3, 2022	15.58% (0.15582)	90.12th	v1
Jan 6, 2022	15.58% (0.15582)	90.00th	v1
Sep 1, 2021	15.58% (0.15582)	97.30th	v1
Apr 14, 2021	15.58% (0.15582)	0.00th	v1

Weaknesses (1)

CWE-787

Out-of-bounds Write

References (3)

http://www.securityfocus.com/bid/105033
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1041457
vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8403
x_refsource_CONFIRMPatchVendor Advisory

Link	Providers	Tags
http://www.securityfocus.com/bid/105033		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1041457		vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8403		x_refsource_CONFIRMPatchVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner microsoft

Published Aug 15, 2018

Updated Aug 5, 2024

Reserved Mar 14, 2018

Link CVE-2018-8403

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2018-8403

Red Hat

Severity n/a

Public date n/a

Links CVE-2018-8403