CVE-2018-8577 — A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Remote Code Execution Vulnerability." This affects Microsoft Office, Office 365 ProPlus, Microsoft Excel, Microsoft Excel Viewer, Excel

Back Back to CVE browser

HIGH

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Remote Code Execution Vulnerability." This affects Microsoft Office, Office 365 ProPlus, Microsoft Excel, Microsoft Excel Viewer, Excel

Published Nov 14, 2018

7.8

HIGH

CVSS 3.0

EPSS 19.06%

Description

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Remote Code Execution Vulnerability." This affects Microsoft Office, Office 365 ProPlus, Microsoft Excel, Microsoft Excel Viewer, Excel. This CVE ID is unique from CVE-2018-8574.

Affected products

Vendor Microsoft Product Excel Default
n/a
- Version
  Services on Microsoft SharePoint Server 2010 Service Pack 2
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Microsoft Excel Default
n/a
- Version
  2010 Service Pack 2 (32-bit editions)
  Status
  affected
  Constraints
  -
- Version
  2010 Service Pack 2 (64-bit editions)
  Status
  affected
  Constraints
  -
- Version
  2013 RT Service Pack 1
  Status
  affected
  Constraints
  -
- Version
  2013 Service Pack 1 (32-bit editions)
  Status
  affected
  Constraints
  -
- Version
  2013 Service Pack 1 (64-bit editions)
  Status
  affected
  Constraints
  -
- Version
  2016 (32-bit edition)
  Status
  affected
  Constraints
  -
- Version
  2016 (64-bit edition)
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Microsoft Excel Viewer Default
n/a
- Version
  2007 Service Pack 3
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Microsoft Office Default
n/a
- Version
  2010 Service Pack 2 (32-bit editions)
  Status
  affected
  Constraints
  -
- Version
  2010 Service Pack 2 (64-bit editions)
  Status
  affected
  Constraints
  -
- Version
  2013 RT Service Pack 1
  Status
  affected
  Constraints
  -
- Version
  2013 Service Pack 1 (32-bit editions)
  Status
  affected
  Constraints
  -
- Version
  2013 Service Pack 1 (64-bit editions)
  Status
  affected
  Constraints
  -
- Version
  2016 (32-bit edition)
  Status
  affected
  Constraints
  -
- Version
  2016 (64-bit edition)
  Status
  affected
  Constraints
  -
- Version
  2016 for Mac
  Status
  affected
  Constraints
  -
- Version
  2019 for 32-bit editions
  Status
  affected
  Constraints
  -
- Version
  2019 for 64-bit editions
  Status
  affected
  Constraints
  -
- Version
  2019 for Mac
  Status
  affected
  Constraints
  -
- Version
  Compatibility Pack Service Pack 3
  Status
  affected
  Constraints
  -
- Version
  Web Apps Server 2013 Service Pack 1
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Office Default
n/a
- Version
  365 ProPlus for 32-bit Systems
  Status
  affected
  Constraints
  -
- Version
  365 ProPlus for 64-bit Systems
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Microsoft

Excel

n/a

Version	Status	Constraints
Services on Microsoft SharePoint Server 2010 Service Pack 2	affected	-

Microsoft

Microsoft Excel

n/a

Version	Status	Constraints
2010 Service Pack 2 (32-bit editions)	affected	-
2010 Service Pack 2 (64-bit editions)	affected	-
2013 RT Service Pack 1	affected	-
2013 Service Pack 1 (32-bit editions)	affected	-
2013 Service Pack 1 (64-bit editions)	affected	-
2016 (32-bit edition)	affected	-
2016 (64-bit edition)	affected	-

Microsoft

Microsoft Excel Viewer

n/a

Version	Status	Constraints
2007 Service Pack 3	affected	-

Microsoft

Microsoft Office

n/a

Version	Status	Constraints
2010 Service Pack 2 (32-bit editions)	affected	-
2010 Service Pack 2 (64-bit editions)	affected	-
2013 RT Service Pack 1	affected	-
2013 Service Pack 1 (32-bit editions)	affected	-
2013 Service Pack 1 (64-bit editions)	affected	-
2016 (32-bit edition)	affected	-
2016 (64-bit edition)	affected	-
2016 for Mac	affected	-
2019 for 32-bit editions	affected	-
2019 for 64-bit editions	affected	-
2019 for Mac	affected	-
Compatibility Pack Service Pack 3	affected	-
Web Apps Server 2013 Service Pack 1	affected	-

Microsoft

Office

n/a

Version	Status	Constraints
365 ProPlus for 32-bit Systems	affected	-
365 ProPlus for 64-bit Systems	affected	-

Remediation

No remediation recorded yet.

Metrics

19.06% 0.19059

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.19059

Score over time

2021–2026

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (55 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	19.06% (0.19059)	97.23th	v5 (v2026.06.15)
Sep 22, 2026	19.06% (0.19059)	97.19th	v5 (v2026.06.15)
Sep 21, 2026	17.39% (0.17386)	97.04th	v5 (v2026.06.15)
Sep 6, 2026	19.06% (0.19059)	97.12th	v5 (v2026.06.15)
Sep 5, 2026	17.39% (0.17386)	96.97th	v5 (v2026.06.15)
Aug 30, 2026	19.06% (0.19059)	97.11th	v5 (v2026.06.15)
Aug 28, 2026	17.39% (0.17386)	96.96th	v5 (v2026.06.15)
Aug 24, 2026	19.06% (0.19059)	97.09th	v5 (v2026.06.15)
Aug 23, 2026	17.39% (0.17386)	96.95th	v5 (v2026.06.15)
Jun 15, 2026	19.06% (0.19059)	96.94th	v5 (v2026.06.15)
May 2, 2026	29.48% (0.29479)	96.63th	v4 (v2025.03.14)
Apr 4, 2026	32.80% (0.32803)	96.86th	v4 (v2025.03.14)
Mar 8, 2026	30.51% (0.30512)	96.62th	v4 (v2025.03.14)
Nov 21, 2025	24.87% (0.24873)	95.93th	v4 (v2025.03.14)
Nov 18, 2025	23.49% (0.23487)	95.62th	v4 (v2025.03.14)
Nov 8, 2025	24.87% (0.24873)	95.91th	v4 (v2025.03.14)
Oct 30, 2025	15.56% (0.15563)	94.38th	v4 (v2025.03.14)
Jun 12, 2025	19.36% (0.19365)	95.06th	v4 (v2025.03.14)
Jun 11, 2025	16.08% (0.16078)	94.45th	v4 (v2025.03.14)
Mar 30, 2025	18.57% (0.18565)	94.74th	v4 (v2025.03.14)
Mar 29, 2025	35.39% (0.35388)	95.45th	v4 (v2025.03.14)
Mar 19, 2025	18.57% (0.18565)	94.51th	v4 (v2025.03.14)
Mar 17, 2025	27.33% (0.27334)	95.99th	v4 (v2025.03.14)
Dec 17, 2024	85.42% (0.85422)	98.77th	v3 (v2023.03.01)
Nov 29, 2024	34.30% (0.34297)	97.23th	v3 (v2023.03.01)
Oct 24, 2024	30.62% (0.30621)	97.04th	v3 (v2023.03.01)
Sep 23, 2024	18.35% (0.18349)	96.29th	v3 (v2023.03.01)
Aug 29, 2024	11.41% (0.11408)	95.32th	v3 (v2023.03.01)
Jul 3, 2024	12.82% (0.12819)	95.52th	v3 (v2023.03.01)
Apr 27, 2024	11.78% (0.11780)	95.24th	v3 (v2023.03.01)
Apr 6, 2024	9.47% (0.09467)	94.63th	v3 (v2023.03.01)
Feb 23, 2024	8.32% (0.08322)	94.18th	v3 (v2023.03.01)
Nov 7, 2023	7.87% (0.07866)	93.53th	v3 (v2023.03.01)
Aug 14, 2023	6.71% (0.06714)	92.91th	v3 (v2023.03.01)
Jul 31, 2023	57.82% (0.57817)	97.24th	v3 (v2023.03.01)
Jul 11, 2023	33.27% (0.33266)	96.46th	v3 (v2023.03.01)
Jun 29, 2023	48.47% (0.48467)	96.97th	v3 (v2023.03.01)
Jun 9, 2023	28.35% (0.28351)	96.22th	v3 (v2023.03.01)
May 27, 2023	54.76% (0.54756)	97.11th	v3 (v2023.03.01)
Apr 26, 2023	16.52% (0.16518)	95.19th	v3 (v2023.03.01)
Apr 11, 2023	30.38% (0.30381)	96.29th	v3 (v2023.03.01)
Mar 27, 2023	29.77% (0.29772)	96.22th	v3 (v2023.03.01)
Mar 7, 2023	31.99% (0.31992)	96.28th	v3 (v2023.03.01)
Mar 6, 2023	34.60% (0.34599)	97.77th	v2 (v2022.01.01)
Dec 14, 2022	32.42% (0.32419)	97.57th	v2 (v2022.01.01)
Oct 30, 2022	31.10% (0.31104)	97.49th	v2 (v2022.01.01)
Sep 26, 2022	27.14% (0.27139)	97.06th	v2 (v2022.01.01)
Aug 20, 2022	23.10% (0.23099)	96.51th	v2 (v2022.01.01)
May 10, 2022	21.36% (0.21361)	96.31th	v2 (v2022.01.01)
Apr 1, 2022	17.27% (0.17269)	95.90th	v2 (v2022.01.01)
Feb 4, 2022	17.27% (0.17269)	93.17th	v2 (v2022.01.01)
Feb 3, 2022	17.55% (0.17549)	91.03th	v1
Jan 6, 2022	17.55% (0.17549)	90.92th	v1
Sep 1, 2021	17.55% (0.17549)	97.67th	v1
Apr 14, 2021	17.55% (0.17549)	0.00th	v1

Weaknesses (0)

No CWE recorded.

References (3)

http://www.securityfocus.com/bid/105834
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1042134
vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8577
x_refsource_CONFIRMPatchVendor Advisory

Link	Providers	Tags
http://www.securityfocus.com/bid/105834		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1042134		vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8577		x_refsource_CONFIRMPatchVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner microsoft

Published Nov 14, 2018

Updated Aug 5, 2024

Reserved Mar 14, 2018

Link CVE-2018-8577

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2018-8577

Red Hat

Severity n/a

Public date n/a

Links CVE-2018-8577