CVE-2018-0922
First published: Wed Mar 14 2018(Updated: )
Microsoft Office 2010 SP2, 2013 SP1, and 2016, Microsoft Office 2016 Click-to-Run Microsoft Office 2016 for Mac, Microsoft Office Compatibility Pack SP2, Microsoft Office Web Apps 2010 SP2, Microsoft Office Web Apps 2013 SP1, Microsoft Office Word Viewer, Microsoft SharePoint Enterprise Server 2013 SP1, Microsoft SharePoint Enterprise Server 2016, Microsoft Office Compatibility Pack SP2, Microsoft Online Server 2016, Microsoft SharePoint Server 2010 SP2, Microsoft Word 2007 SP3, Microsoft Word 2010 SP2, Word 2013 and Microsoft Word 2016 allow a remote code execution vulnerability due to how objects are handled in memory, aka "Microsoft Office Memory Corruption Vulnerability".
Credit: secure@microsoft.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft Office | =2010-sp2 | |
| Microsoft Office | =2013-sp1 | |
| Microsoft Office | =2016 | |
| Microsoft Office | =2016 | |
| Microsoft Office | =2016 | |
| Microsoft Office Compatibility Pack | =sp2 | |
| Microsoft Office Online Server | =2016 | |
| Microsoft Office Web Apps | =2010-sp2 | |
| Microsoft Office Web Apps | =2013-sp1 | |
| Microsoft Office Word Viewer | ||
| Microsoft SharePoint Enterprise Server | =2013-sp1 | |
| Microsoft SharePoint Enterprise Server | =2016 | |
| Microsoft SharePoint Server | =2010-sp2 | |
| Microsoft Word | =2007-sp3 | |
| Microsoft Word | =2010-sp2 | |
| Microsoft Word | =2013 | |
| Microsoft Word | =2016 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2018-0922?
CVE-2018-0922 is a vulnerability in Microsoft Office and SharePoint that can allow remote code execution when a user opens a specially crafted file.
Which versions of Microsoft Office are affected by CVE-2018-0922?
Microsoft Office 2010 SP2, 2013 SP1, and 2016, Microsoft Office 2016 Click-to-Run, Microsoft Office 2016 for Mac, and Microsoft Office Compatibility Pack SP2 are affected.
What is the severity of CVE-2018-0922?
The severity of CVE-2018-0922 is critical, with a severity value of 7.8.
How can CVE-2018-0922 be exploited?
CVE-2018-0922 can be exploited by tricking a user into opening a specially crafted file, which can then execute remote code, potentially allowing an attacker to take control of the affected system.
Are there any known fixes for CVE-2018-0922?
Yes, Microsoft has released security updates to address the vulnerability. It is recommended to install the latest updates for the affected software.
- collector/nvd-index
- agent/weakness
- agent/type
- agent/description
- agent/author
- agent/severity
- agent/references
- agent/event
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/microsoft
- canonical/microsoft office
- version/microsoft office/2010-sp2
- version/microsoft office/2013-sp1
- version/microsoft office/2016
- canonical/microsoft office compatibility pack
- version/microsoft office compatibility pack/sp2
- canonical/microsoft office online server
- version/microsoft office online server/2016
- canonical/microsoft office web apps
- version/microsoft office web apps/2010-sp2
- version/microsoft office web apps/2013-sp1
- canonical/microsoft office word viewer
- canonical/microsoft sharepoint enterprise server
- version/microsoft sharepoint enterprise server/2013-sp1
- version/microsoft sharepoint enterprise server/2016
- canonical/microsoft sharepoint server
- version/microsoft sharepoint server/2010-sp2
- canonical/microsoft word
- version/microsoft word/2007-sp3
- version/microsoft word/2010-sp2
- version/microsoft word/2013
- version/microsoft word/2016