CVE-2018-8432 — A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka "Microsoft Graphics Components Remote Code Execution Vulnerability." This affects Windows 7, Microsoft Office, Microsoft Office Word Viewer, Office 365 ProPlus, Microsoft Excel Viewer, Microsoft PowerPoint Viewer, Windows Server 2019, Windows Server 2008 R2, Windows 10, Windows Server 2008

Back Back to CVE browser

HIGH

A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka "Microsoft Graphics Components Remote Code Execution Vulnerability." This affects Windows 7, Microsoft Office, Microsoft Office Word Viewer, Office 365 ProPlus, Microsoft Excel Viewer, Microsoft PowerPoint Viewer, Windows Server 2019, Windows Server 2008 R2, Windows 10, Windows Server 2008

Published Oct 10, 2018

7.8

HIGH

CVSS 3.0

EPSS 19.55%

Description

A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka "Microsoft Graphics Components Remote Code Execution Vulnerability." This affects Windows 7, Microsoft Office, Microsoft Office Word Viewer, Office 365 ProPlus, Microsoft Excel Viewer, Microsoft PowerPoint Viewer, Windows Server 2019, Windows Server 2008 R2, Windows 10, Windows Server 2008.

Affected products

Vendor Microsoft Product Microsoft Excel Viewer Default
n/a
- Version
  2007 Service Pack 3
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Microsoft Office Default
n/a
- Version
  2016 for Mac
  Status
  affected
  Constraints
  -
- Version
  2019 for 32-bit editions
  Status
  affected
  Constraints
  -
- Version
  2019 for 64-bit editions
  Status
  affected
  Constraints
  -
- Version
  Compatibility Pack Service Pack 3
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Microsoft Office Word Viewer Default
n/a
- Version
  Microsoft Office Word Viewer
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Microsoft PowerPoint Viewer Default
n/a
- Version
  2007
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Office Default
n/a
- Version
  365 ProPlus for 32-bit Systems
  Status
  affected
  Constraints
  -
- Version
  365 ProPlus for 64-bit Systems
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Windows 10 Default
n/a
- Version
  Version 1809 for 32-bit Systems
  Status
  affected
  Constraints
  -
- Version
  Version 1809 for x64-based Systems
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Windows 7 Default
n/a
- Version
  32-bit Systems Service Pack 1
  Status
  affected
  Constraints
  -
- Version
  x64-based Systems Service Pack 1
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Windows Server 2008 Default
n/a
- Version
  32-bit Systems Service Pack 2
  Status
  affected
  Constraints
  -
- Version
  32-bit Systems Service Pack 2 (Server Core installation)
  Status
  affected
  Constraints
  -
- Version
  Itanium-Based Systems Service Pack 2
  Status
  affected
  Constraints
  -
- Version
  x64-based Systems Service Pack 2
  Status
  affected
  Constraints
  -
- Version
  x64-based Systems Service Pack 2 (Server Core installation)
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Windows Server 2008 R2 Default
n/a
- Version
  Itanium-Based Systems Service Pack 1
  Status
  affected
  Constraints
  -
- Version
  x64-based Systems Service Pack 1
  Status
  affected
  Constraints
  -
- Version
  x64-based Systems Service Pack 1 (Server Core installation)
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Windows Server 2019 Default
n/a
- Version
  (Server Core installation)
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Microsoft

Microsoft Excel Viewer

n/a

Version	Status	Constraints
2007 Service Pack 3	affected	-

Microsoft

Microsoft Office

n/a

Version	Status	Constraints
2016 for Mac	affected	-
2019 for 32-bit editions	affected	-
2019 for 64-bit editions	affected	-
Compatibility Pack Service Pack 3	affected	-

Microsoft

Microsoft Office Word Viewer

n/a

Version	Status	Constraints
Microsoft Office Word Viewer	affected	-

Microsoft

Microsoft PowerPoint Viewer

n/a

Version	Status	Constraints
2007	affected	-

Microsoft

Office

n/a

Version	Status	Constraints
365 ProPlus for 32-bit Systems	affected	-
365 ProPlus for 64-bit Systems	affected	-

Microsoft

Windows 10

n/a

Version	Status	Constraints
Version 1809 for 32-bit Systems	affected	-
Version 1809 for x64-based Systems	affected	-

Microsoft

Windows 7

n/a

Version	Status	Constraints
32-bit Systems Service Pack 1	affected	-
x64-based Systems Service Pack 1	affected	-

Microsoft

Windows Server 2008

n/a

Version	Status	Constraints
32-bit Systems Service Pack 2	affected	-
32-bit Systems Service Pack 2 (Server Core installation)	affected	-
Itanium-Based Systems Service Pack 2	affected	-
x64-based Systems Service Pack 2	affected	-
x64-based Systems Service Pack 2 (Server Core installation)	affected	-

Microsoft

Windows Server 2008 R2

n/a

Version	Status	Constraints
Itanium-Based Systems Service Pack 1	affected	-
x64-based Systems Service Pack 1	affected	-
x64-based Systems Service Pack 1 (Server Core installation)	affected	-

Microsoft

Windows Server 2019

n/a

Version	Status	Constraints
(Server Core installation)	affected	-

Remediation

No remediation recorded yet.

Metrics

19.55% 0.19546

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.

EPSS probability 0.19546

Score over time

2021–2026

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (52 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 2, 2026	19.55% (0.19546)	97.31th	v5 (v2026.06.15)
Sep 22, 2026	19.55% (0.19546)	97.26th	v5 (v2026.06.15)
Sep 21, 2026	17.59% (0.17587)	97.07th	v5 (v2026.06.15)
Sep 6, 2026	19.55% (0.19546)	97.20th	v5 (v2026.06.15)
Sep 5, 2026	17.59% (0.17587)	97.00th	v5 (v2026.06.15)
Aug 30, 2026	19.55% (0.19546)	97.18th	v5 (v2026.06.15)
Aug 28, 2026	17.66% (0.17663)	97.00th	v5 (v2026.06.15)
Aug 24, 2026	19.63% (0.19629)	97.18th	v5 (v2026.06.15)
Aug 23, 2026	17.66% (0.17663)	96.99th	v5 (v2026.06.15)
Jun 15, 2026	19.63% (0.19629)	97.04th	v5 (v2026.06.15)
Mar 28, 2026	33.91% (0.33910)	96.93th	v4 (v2025.03.14)
Feb 28, 2026	31.20% (0.31196)	96.65th	v4 (v2025.03.14)
Feb 1, 2026	28.96% (0.28958)	96.47th	v4 (v2025.03.14)
Nov 3, 2025	23.49% (0.23487)	95.77th	v4 (v2025.03.14)
Oct 4, 2025	24.72% (0.24720)	95.94th	v4 (v2025.03.14)
Mar 30, 2025	16.31% (0.16307)	94.29th	v4 (v2025.03.14)
Mar 29, 2025	28.88% (0.28882)	94.55th	v4 (v2025.03.14)
Mar 19, 2025	16.31% (0.16307)	94.05th	v4 (v2025.03.14)
Mar 17, 2025	24.40% (0.24398)	95.64th	v4 (v2025.03.14)
Dec 17, 2024	85.42% (0.85422)	98.77th	v3 (v2023.03.01)
Oct 25, 2024	34.30% (0.34297)	97.18th	v3 (v2023.03.01)
Sep 19, 2024	30.62% (0.30621)	97.01th	v3 (v2023.03.01)
Aug 19, 2024	18.35% (0.18349)	96.29th	v3 (v2023.03.01)
Jul 25, 2024	11.41% (0.11408)	95.27th	v3 (v2023.03.01)
Jun 25, 2024	13.00% (0.12997)	95.53th	v3 (v2023.03.01)
May 29, 2024	12.82% (0.12819)	95.47th	v3 (v2023.03.01)
Mar 23, 2024	11.78% (0.11780)	95.17th	v3 (v2023.03.01)
Mar 2, 2024	9.47% (0.09467)	94.58th	v3 (v2023.03.01)
Jan 19, 2024	8.32% (0.08322)	93.77th	v3 (v2023.03.01)
Oct 4, 2023	7.87% (0.07866)	93.45th	v3 (v2023.03.01)
Jul 11, 2023	6.71% (0.06714)	92.86th	v3 (v2023.03.01)
Jun 27, 2023	57.82% (0.57817)	97.21th	v3 (v2023.03.01)
Jun 7, 2023	33.27% (0.33266)	96.44th	v3 (v2023.03.01)
May 26, 2023	48.47% (0.48467)	96.92th	v3 (v2023.03.01)
May 6, 2023	28.35% (0.28351)	96.18th	v3 (v2023.03.01)
Apr 23, 2023	54.76% (0.54756)	97.09th	v3 (v2023.03.01)
Mar 23, 2023	16.52% (0.16518)	95.14th	v3 (v2023.03.01)
Mar 8, 2023	30.38% (0.30381)	96.21th	v3 (v2023.03.01)
Mar 7, 2023	29.77% (0.29772)	96.19th	v3 (v2023.03.01)
Mar 6, 2023	34.60% (0.34599)	97.77th	v2 (v2022.01.01)
Jan 31, 2023	34.60% (0.34599)	97.75th	v2 (v2022.01.01)
Nov 10, 2022	32.42% (0.32419)	97.57th	v2 (v2022.01.01)
Sep 26, 2022	31.10% (0.31104)	97.47th	v2 (v2022.01.01)
Aug 23, 2022	27.14% (0.27139)	97.04th	v2 (v2022.01.01)
Jul 17, 2022	23.10% (0.23099)	96.62th	v2 (v2022.01.01)
Apr 6, 2022	21.36% (0.21361)	96.28th	v2 (v2022.01.01)
Apr 1, 2022	17.27% (0.17269)	95.90th	v2 (v2022.01.01)
Feb 4, 2022	17.27% (0.17269)	93.17th	v2 (v2022.01.01)
Feb 3, 2022	17.55% (0.17549)	91.03th	v1
Jan 6, 2022	17.55% (0.17549)	90.92th	v1
Sep 1, 2021	17.55% (0.17549)	97.67th	v1
Apr 14, 2021	17.55% (0.17549)	0.00th	v1

Weaknesses (0)

No CWE recorded.

References (3)

http://www.securityfocus.com/bid/105458
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1041823
vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8432
x_refsource_CONFIRMPatchVendor Advisory

Link	Providers	Tags
http://www.securityfocus.com/bid/105458		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1041823		vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8432		x_refsource_CONFIRMPatchVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner microsoft

Published Oct 10, 2018

Updated Aug 5, 2024

Reserved Mar 14, 2018

Link CVE-2018-8432

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2018-8432

Red Hat

Severity n/a

Public date n/a

Links CVE-2018-8432