CVE-2018-8627 — An information disclosure vulnerability exists when Microsoft Excel software reads out of bound memory due to an uninitialized variable, which could disclose the contents of memory, aka "Microsoft Excel Information Disclosure Vulnerability." This affects Microsoft Office, Office 365 ProPlus, Microsoft Excel, Microsoft Excel Viewer, Excel

Back Back to CVE browser

MEDIUM

An information disclosure vulnerability exists when Microsoft Excel software reads out of bound memory due to an uninitialized variable, which could disclose the contents of memory, aka "Microsoft Excel Information Disclosure Vulnerability." This affects Microsoft Office, Office 365 ProPlus, Microsoft Excel, Microsoft Excel Viewer, Excel

Published Dec 12, 2018

5.5

MEDIUM

CVSS 3.0

EPSS 8.62%

Description

An information disclosure vulnerability exists when Microsoft Excel software reads out of bound memory due to an uninitialized variable, which could disclose the contents of memory, aka "Microsoft Excel Information Disclosure Vulnerability." This affects Microsoft Office, Office 365 ProPlus, Microsoft Excel, Microsoft Excel Viewer, Excel. This CVE ID is unique from CVE-2018-8598.

Affected products

Vendor Microsoft Product Excel Default
n/a
- Version
  Services on Microsoft SharePoint Server 2010 Service Pack 2
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Microsoft Excel Default
n/a
- Version
  2010 Service Pack 2 (32-bit editions)
  Status
  affected
  Constraints
  -
- Version
  2010 Service Pack 2 (64-bit editions)
  Status
  affected
  Constraints
  -
- Version
  2013 RT Service Pack 1
  Status
  affected
  Constraints
  -
- Version
  2013 Service Pack 1 (32-bit editions)
  Status
  affected
  Constraints
  -
- Version
  2013 Service Pack 1 (64-bit editions)
  Status
  affected
  Constraints
  -
- Version
  2016 (32-bit edition)
  Status
  affected
  Constraints
  -
- Version
  2016 (64-bit edition)
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Microsoft Excel Viewer Default
n/a
- Version
  2007 Service Pack 3
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Microsoft Office Default
n/a
- Version
  2010 Service Pack 2 (32-bit editions)
  Status
  affected
  Constraints
  -
- Version
  2010 Service Pack 2 (64-bit editions)
  Status
  affected
  Constraints
  -
- Version
  2016 for Mac
  Status
  affected
  Constraints
  -
- Version
  2019 for 32-bit editions
  Status
  affected
  Constraints
  -
- Version
  2019 for 64-bit editions
  Status
  affected
  Constraints
  -
- Version
  2019 for Mac
  Status
  affected
  Constraints
  -
- Version
  Compatibility Pack Service Pack 3
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Office Default
n/a
- Version
  365 ProPlus for 32-bit Systems
  Status
  affected
  Constraints
  -
- Version
  365 ProPlus for 64-bit Systems
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Microsoft

Excel

n/a

Version	Status	Constraints
Services on Microsoft SharePoint Server 2010 Service Pack 2	affected	-

Microsoft

Microsoft Excel

n/a

Version	Status	Constraints
2010 Service Pack 2 (32-bit editions)	affected	-
2010 Service Pack 2 (64-bit editions)	affected	-
2013 RT Service Pack 1	affected	-
2013 Service Pack 1 (32-bit editions)	affected	-
2013 Service Pack 1 (64-bit editions)	affected	-
2016 (32-bit edition)	affected	-
2016 (64-bit edition)	affected	-

Microsoft

Microsoft Excel Viewer

n/a

Version	Status	Constraints
2007 Service Pack 3	affected	-

Microsoft

Microsoft Office

n/a

Version	Status	Constraints
2010 Service Pack 2 (32-bit editions)	affected	-
2010 Service Pack 2 (64-bit editions)	affected	-
2016 for Mac	affected	-
2019 for 32-bit editions	affected	-
2019 for 64-bit editions	affected	-
2019 for Mac	affected	-
Compatibility Pack Service Pack 3	affected	-

Microsoft

Office

n/a

Version	Status	Constraints
365 ProPlus for 32-bit Systems	affected	-
365 ProPlus for 64-bit Systems	affected	-

Remediation

No remediation recorded yet.

Metrics

8.62% 0.08624

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.08624

Score over time

2021–2026

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (40 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	8.62% (0.08624)	94.94th	v5 (v2026.06.15)
Sep 22, 2026	8.62% (0.08624)	94.86th	v5 (v2026.06.15)
Sep 21, 2026	6.31% (0.06311)	93.38th	v5 (v2026.06.15)
Sep 6, 2026	8.62% (0.08624)	94.73th	v5 (v2026.06.15)
Sep 5, 2026	6.31% (0.06311)	93.23th	v5 (v2026.06.15)
Aug 30, 2026	8.62% (0.08624)	94.70th	v5 (v2026.06.15)
Aug 28, 2026	5.68% (0.05677)	92.49th	v5 (v2026.06.15)
Aug 24, 2026	8.19% (0.08185)	94.43th	v5 (v2026.06.15)
Aug 23, 2026	5.68% (0.05677)	92.46th	v5 (v2026.06.15)
Jun 15, 2026	8.66% (0.08662)	94.41th	v5 (v2026.06.15)
May 30, 2026	18.75% (0.18751)	95.40th	v4 (v2025.03.14)
May 2, 2026	23.53% (0.23533)	96.00th	v4 (v2025.03.14)
Apr 5, 2026	28.65% (0.28648)	96.52th	v4 (v2025.03.14)
Dec 28, 2025	25.11% (0.25107)	95.99th	v4 (v2025.03.14)
Dec 27, 2025	24.11% (0.24107)	95.89th	v4 (v2025.03.14)
Dec 14, 2025	25.24% (0.25235)	95.98th	v4 (v2025.03.14)
Nov 21, 2025	24.11% (0.24107)	95.83th	v4 (v2025.03.14)
Nov 18, 2025	27.64% (0.27642)	96.14th	v4 (v2025.03.14)
Oct 30, 2025	23.59% (0.23585)	95.74th	v4 (v2025.03.14)
Jun 11, 2025	19.88% (0.19881)	95.14th	v4 (v2025.03.14)
Mar 30, 2025	17.53% (0.17532)	94.55th	v4 (v2025.03.14)
Mar 29, 2025	30.04% (0.30035)	94.73th	v4 (v2025.03.14)
Mar 17, 2025	17.53% (0.17532)	94.58th	v4 (v2025.03.14)
Dec 12, 2024	0.27% (0.00265)	66.65th	v3 (v2023.03.01)
Feb 8, 2024	0.27% (0.00265)	65.22th	v3 (v2023.03.01)
May 24, 2023	0.27% (0.00265)	62.71th	v3 (v2023.03.01)
May 9, 2023	0.30% (0.00298)	64.79th	v3 (v2023.03.01)
Apr 24, 2023	0.30% (0.00303)	65.13th	v3 (v2023.03.01)
Mar 8, 2023	0.30% (0.00298)	64.57th	v3 (v2023.03.01)
Mar 7, 2023	0.28% (0.00276)	63.13th	v3 (v2023.03.01)
Mar 6, 2023	5.20% (0.05203)	89.68th	v2 (v2022.01.01)
Oct 24, 2022	5.20% (0.05203)	89.33th	v2 (v2022.01.01)
Sep 17, 2022	4.43% (0.04434)	87.77th	v2 (v2022.01.01)
Jun 7, 2022	4.03% (0.04026)	84.83th	v2 (v2022.01.01)
Apr 1, 2022	3.36% (0.03358)	82.80th	v2 (v2022.01.01)
Feb 4, 2022	3.36% (0.03358)	65.90th	v2 (v2022.01.01)
Feb 3, 2022	6.70% (0.06701)	83.28th	v1
Jan 6, 2022	6.70% (0.06701)	83.12th	v1
Sep 1, 2021	6.70% (0.06701)	91.08th	v1
Apr 14, 2021	6.70% (0.06701)	0.00th	v1

Weaknesses (1)

CWE-908

References (2)

http://www.securityfocus.com/bid/106120
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8627
x_refsource_CONFIRMPatchVendor Advisory

Link	Providers	Tags
http://www.securityfocus.com/bid/106120		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8627		x_refsource_CONFIRMPatchVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner microsoft

Published Dec 12, 2018

Updated Aug 5, 2024

Reserved Mar 14, 2018

Link CVE-2018-8627

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2018-8627

Red Hat

Severity n/a

Public date n/a

Links CVE-2018-8627