CVE-2018-1028: Code Injection

Published Apr 12, 2018

Updated

A remote code execution vulnerability exists when the Office graphics component improperly handles specially crafted embedded fonts, aka "Microsoft Office Graphics Remote Code Execution Vulnerability." This affects Word, Microsoft Office, Microsoft SharePoint, Excel, Microsoft SharePoint Server.

Affected Software

10 affected components

Microsoft Excel Services

Microsoft Office=2013-sp1

Microsoft Office=2013_rt-sp1

Microsoft Office=2016

Microsoft Office 2010=sp2

Microsoft Office Web Apps=2010-sp2

Microsoft Office Web Apps=2013-sp1

Microsoft SharePoint Enterprise Server=2013-sp1

Microsoft SharePoint Enterprise Server=2016

Microsoft Word Automation Services

Remediation

Patch Available

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-1028

Event History

Apr 12, 2018

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2018-1028?

CVE-2018-1028 is a remote code execution vulnerability that exists in the Office graphics component.

How does CVE-2018-1028 affect Microsoft Office?

CVE-2018-1028 affects Microsoft Office, including Word, Excel, and SharePoint.

What is the severity of CVE-2018-1028?

CVE-2018-1028 has a severity value of 8.8, which is considered critical.

How can I fix CVE-2018-1028?

To fix CVE-2018-1028, apply the latest security updates and patches provided by Microsoft.

Where can I find more information about CVE-2018-1028?

You can find more information about CVE-2018-1028 on the Microsoft Security Guidance Advisory page and the SecurityFocus and SecurityTracker websites.