CVE-2018-8172: High severity Microsoft Expression Blend vulnerability

Published Jul 11, 2018

Updated

A remote code execution vulnerability exists in Visual Studio software when the software does not check the source markup of a file for an unbuilt project, aka "Visual Studio Remote Code Execution Vulnerability." This affects Microsoft Visual Studio, Expression Blend 4.

Affected Software

9 affected components

Microsoft Expression Blend=2-sp2

Microsoft Expression Blend=3-sp1

Microsoft Expression Blend=4-sp3

Microsoft Visual Studio=2010-sp1

Microsoft Visual Studio=2012-update_5

Microsoft Visual Studio=2013-update_5

Microsoft Visual Studio=2015-update3

Microsoft Visual Studio 2017

Microsoft Visual Studio 2017=15.7.5

Remediation

Patch Available

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8172

Event History

Jul 11, 2018

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Data Sourced

via NVD·12:29 AM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

What is CVE-2018-8172?

CVE-2018-8172 is a remote code execution vulnerability in Visual Studio software.

What is the severity of CVE-2018-8172?

CVE-2018-8172 has a severity score of 7.8, which is considered critical.

Which software is affected by CVE-2018-8172?

Microsoft Visual Studio and Microsoft Expression Blend 2, 3, and 4 are affected by CVE-2018-8172.

How can I fix CVE-2018-8172?

To fix CVE-2018-8172, you should apply the necessary security updates provided by Microsoft.

Where can I find more information about CVE-2018-8172?

You can find more information about CVE-2018-8172 on the following websites: [1] http://www.securityfocus.com/bid/104616 [2] http://www.securitytracker.com/id/1041253 [3] https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8172