CVE-2018-8628 — A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory, aka "Microsoft PowerPoint Remote Code Execution Vulnerability." This affects Microsoft Office, Office 365 ProPlus, Microsoft PowerPoint, Microsoft SharePoint, Microsoft PowerPoint Viewer, Office Online Server, Microsoft SharePoint Server

Back Back to CVE browser

HIGH

A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory, aka "Microsoft PowerPoint Remote Code Execution Vulnerability." This affects Microsoft Office, Office 365 ProPlus, Microsoft PowerPoint, Microsoft SharePoint, Microsoft PowerPoint Viewer, Office Online Server, Microsoft SharePoint Server

Published Dec 12, 2018

7.8

HIGH

CVSS 3.0

EPSS 15.90%

Description

A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory, aka "Microsoft PowerPoint Remote Code Execution Vulnerability." This affects Microsoft Office, Office 365 ProPlus, Microsoft PowerPoint, Microsoft SharePoint, Microsoft PowerPoint Viewer, Office Online Server, Microsoft SharePoint Server.

Affected products

Vendor Microsoft Product Microsoft Office Default
n/a
- Version
  2016 for Mac
  Status
  affected
  Constraints
  -
- Version
  2019 for 32-bit editions
  Status
  affected
  Constraints
  -
- Version
  2019 for 64-bit editions
  Status
  affected
  Constraints
  -
- Version
  2019 for Mac
  Status
  affected
  Constraints
  -
- Version
  Compatibility Pack Service Pack 3
  Status
  affected
  Constraints
  -
- Version
  Web Apps 2010 Service Pack 2
  Status
  affected
  Constraints
  -
- Version
  Web Apps 2013 Service Pack 1
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Microsoft PowerPoint Default
n/a
- Version
  2010 Service Pack 2 (32-bit editions)
  Status
  affected
  Constraints
  -
- Version
  2010 Service Pack 2 (64-bit editions)
  Status
  affected
  Constraints
  -
- Version
  2013 RT Service Pack 1
  Status
  affected
  Constraints
  -
- Version
  2013 Service Pack 1 (32-bit editions)
  Status
  affected
  Constraints
  -
- Version
  2013 Service Pack 1 (64-bit editions)
  Status
  affected
  Constraints
  -
- Version
  2016 (32-bit edition)
  Status
  affected
  Constraints
  -
- Version
  2016 (64-bit edition)
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Microsoft PowerPoint Viewer Default
n/a
- Version
  Microsoft PowerPoint Viewer
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Microsoft SharePoint Default
n/a
- Version
  Enterprise Server 2016
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Microsoft SharePoint Server Default
n/a
- Version
  2013 Service Pack 1
  Status
  affected
  Constraints
  -
- Version
  2019
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Office Default
n/a
- Version
  365 ProPlus for 32-bit Systems
  Status
  affected
  Constraints
  -
- Version
  365 ProPlus for 64-bit Systems
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Office Online Server Default
n/a
- Version
  Office Online Server
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Microsoft

Microsoft Office

n/a

Version	Status	Constraints
2016 for Mac	affected	-
2019 for 32-bit editions	affected	-
2019 for 64-bit editions	affected	-
2019 for Mac	affected	-
Compatibility Pack Service Pack 3	affected	-
Web Apps 2010 Service Pack 2	affected	-
Web Apps 2013 Service Pack 1	affected	-

Microsoft

Microsoft PowerPoint

n/a

Version	Status	Constraints
2010 Service Pack 2 (32-bit editions)	affected	-
2010 Service Pack 2 (64-bit editions)	affected	-
2013 RT Service Pack 1	affected	-
2013 Service Pack 1 (32-bit editions)	affected	-
2013 Service Pack 1 (64-bit editions)	affected	-
2016 (32-bit edition)	affected	-
2016 (64-bit edition)	affected	-

Microsoft

Microsoft PowerPoint Viewer

n/a

Version	Status	Constraints
Microsoft PowerPoint Viewer	affected	-

Microsoft

Microsoft SharePoint

n/a

Version	Status	Constraints
Enterprise Server 2016	affected	-

Microsoft

Microsoft SharePoint Server

n/a

Version	Status	Constraints
2013 Service Pack 1	affected	-
2019	affected	-

Microsoft

Office

n/a

Version	Status	Constraints
365 ProPlus for 32-bit Systems	affected	-
365 ProPlus for 64-bit Systems	affected	-

Microsoft

Office Online Server

n/a

Version	Status	Constraints
Office Online Server	affected	-

Remediation

No remediation recorded yet.

Metrics

15.90% 0.15897

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.15897

Score over time

2021–2026

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (53 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	15.90% (0.15897)	96.79th	v5 (v2026.06.15)
Aug 30, 2026	15.90% (0.15897)	96.65th	v5 (v2026.06.15)
Aug 28, 2026	14.58% (0.14583)	96.45th	v5 (v2026.06.15)
Aug 24, 2026	16.20% (0.16200)	96.69th	v5 (v2026.06.15)
Aug 23, 2026	14.58% (0.14583)	96.44th	v5 (v2026.06.15)
Jun 15, 2026	16.20% (0.16200)	96.52th	v5 (v2026.06.15)
May 30, 2026	27.53% (0.27526)	96.51th	v4 (v2025.03.14)
May 2, 2026	30.75% (0.30747)	96.75th	v4 (v2025.03.14)
Dec 28, 2025	34.53% (0.34534)	96.85th	v4 (v2025.03.14)
Dec 27, 2025	31.34% (0.31336)	96.63th	v4 (v2025.03.14)
Dec 18, 2025	34.53% (0.34534)	96.84th	v4 (v2025.03.14)
Dec 13, 2025	35.65% (0.35652)	96.90th	v4 (v2025.03.14)
Nov 21, 2025	31.34% (0.31336)	96.57th	v4 (v2025.03.14)
Nov 18, 2025	29.76% (0.29762)	96.37th	v4 (v2025.03.14)
Oct 30, 2025	31.16% (0.31163)	96.53th	v4 (v2025.03.14)
Jun 11, 2025	35.60% (0.35597)	96.86th	v4 (v2025.03.14)
May 28, 2025	30.63% (0.30632)	96.45th	v4 (v2025.03.14)
Mar 30, 2025	33.66% (0.33660)	96.58th	v4 (v2025.03.14)
Mar 29, 2025	59.80% (0.59800)	97.50th	v4 (v2025.03.14)
Mar 19, 2025	33.66% (0.33660)	96.41th	v4 (v2025.03.14)
Mar 17, 2025	26.32% (0.26322)	95.88th	v4 (v2025.03.14)
Dec 17, 2024	1.64% (0.01641)	87.18th	v3 (v2023.03.01)
Nov 21, 2024	7.37% (0.07372)	94.31th	v3 (v2023.03.01)
Oct 21, 2024	5.09% (0.05086)	93.11th	v3 (v2023.03.01)
Jul 7, 2024	1.77% (0.01772)	88.13th	v3 (v2023.03.01)
May 25, 2024	1.89% (0.01894)	88.48th	v3 (v2023.03.01)
May 4, 2024	2.24% (0.02236)	89.47th	v3 (v2023.03.01)
Mar 22, 2024	1.79% (0.01788)	87.80th	v3 (v2023.03.01)
Mar 5, 2024	1.53% (0.01534)	86.73th	v3 (v2023.03.01)
Dec 23, 2023	1.92% (0.01923)	87.32th	v3 (v2023.03.01)
Sep 11, 2023	3.01% (0.03006)	89.66th	v3 (v2023.03.01)
Aug 28, 2023	2.39% (0.02394)	88.50th	v3 (v2023.03.01)
Aug 8, 2023	1.70% (0.01702)	86.15th	v3 (v2023.03.01)
Jul 27, 2023	2.39% (0.02394)	88.42th	v3 (v2023.03.01)
Jul 7, 2023	2.36% (0.02360)	88.28th	v3 (v2023.03.01)
Jun 24, 2023	3.83% (0.03831)	90.61th	v3 (v2023.03.01)
May 24, 2023	1.95% (0.01950)	86.93th	v3 (v2023.03.01)
May 9, 2023	2.42% (0.02418)	88.32th	v3 (v2023.03.01)
Apr 24, 2023	2.10% (0.02098)	87.47th	v3 (v2023.03.01)
Mar 22, 2023	1.49% (0.01489)	84.81th	v3 (v2023.03.01)
Mar 7, 2023	1.13% (0.01127)	82.42th	v3 (v2023.03.01)
Mar 6, 2023	12.83% (0.12826)	95.62th	v2 (v2022.01.01)
Jan 11, 2023	12.83% (0.12826)	95.42th	v2 (v2022.01.01)
Nov 27, 2022	12.16% (0.12163)	95.08th	v2 (v2022.01.01)
Oct 24, 2022	10.25% (0.10253)	94.45th	v2 (v2022.01.01)
Sep 17, 2022	8.00% (0.07999)	93.05th	v2 (v2022.01.01)
Jun 7, 2022	7.29% (0.07289)	91.84th	v2 (v2022.01.01)
Apr 1, 2022	5.70% (0.05698)	89.36th	v2 (v2022.01.01)
Feb 4, 2022	5.70% (0.05698)	76.91th	v2 (v2022.01.01)
Feb 3, 2022	13.74% (0.13741)	89.37th	v1
Jan 6, 2022	13.74% (0.13741)	89.25th	v1
Sep 1, 2021	13.74% (0.13741)	96.74th	v1
Apr 14, 2021	13.74% (0.13741)	0.00th	v1

Weaknesses (0)

No CWE recorded.

References (2)

http://www.securityfocus.com/bid/106104
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8628
x_refsource_CONFIRMPatchVendor Advisory

Link	Providers	Tags
http://www.securityfocus.com/bid/106104		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8628		x_refsource_CONFIRMPatchVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner microsoft

Published Dec 12, 2018

Updated Aug 5, 2024

Reserved Mar 14, 2018

Link CVE-2018-8628

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2018-8628

Red Hat

Severity n/a

Public date n/a

Links CVE-2018-8628