CVE-2018-1028: Code Injection
First published: Thu Apr 12 2018(Updated: )
A remote code execution vulnerability exists when the Office graphics component improperly handles specially crafted embedded fonts, aka "Microsoft Office Graphics Remote Code Execution Vulnerability." This affects Word, Microsoft Office, Microsoft SharePoint, Excel, Microsoft SharePoint Server.
Credit: secure@microsoft.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft Excel Services | ||
| Microsoft Office | =2013-sp1 | |
| Microsoft Office | =2013_rt-sp1 | |
| Microsoft Office | =2016 | |
| Microsoft Office 2010 | =sp2 | |
| Microsoft Office Web Apps | =2010-sp2 | |
| Microsoft Office Web Apps | =2013-sp1 | |
| Microsoft SharePoint Enterprise Server | =2013-sp1 | |
| Microsoft SharePoint Enterprise Server | =2016 | |
| Microsoft Word Automation Services |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2018-1028?
CVE-2018-1028 is a remote code execution vulnerability that exists in the Office graphics component.
How does CVE-2018-1028 affect Microsoft Office?
CVE-2018-1028 affects Microsoft Office, including Word, Excel, and SharePoint.
What is the severity of CVE-2018-1028?
CVE-2018-1028 has a severity value of 8.8, which is considered critical.
How can I fix CVE-2018-1028?
To fix CVE-2018-1028, apply the latest security updates and patches provided by Microsoft.
Where can I find more information about CVE-2018-1028?
You can find more information about CVE-2018-1028 on the Microsoft Security Guidance Advisory page and the SecurityFocus and SecurityTracker websites.
- collector/nvd-index
- agent/references
- agent/severity
- agent/weakness
- agent/author
- agent/type
- agent/event
- agent/description
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/microsoft
- canonical/microsoft excel services
- canonical/microsoft office
- version/microsoft office/2013-sp1
- version/microsoft office/2013_rt-sp1
- version/microsoft office/2016
- canonical/microsoft office 2010
- version/microsoft office 2010/sp2
- canonical/microsoft office web apps
- version/microsoft office web apps/2010-sp2
- version/microsoft office web apps/2013-sp1
- canonical/microsoft sharepoint enterprise server
- version/microsoft sharepoint enterprise server/2013-sp1
- version/microsoft sharepoint enterprise server/2016
- canonical/microsoft word automation services