CVE-2018-8598

MEDIUM EXPLOITED IN THE WILD

Microsoft Excel - Information Disclosure via Memory Contents Exposure

Title source: llm

Exploitation Summary

CVE-2018-8598 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io).

Description

An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka "Microsoft Excel Information Disclosure Vulnerability." This affects Office 365 ProPlus, Microsoft Office, Microsoft Excel. This CVE ID is unique from CVE-2018-8627.

References (2)

Core 2

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/106102

Patch, Vendor Advisory x_refsource_confirm

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8598

Scores

CVSS v3 4.7

EPSS 0.0622

EPSS Percentile 92.8%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Details

VulnCheck KEV 2021-01-21

InTheWild.io 2019-01-02

Status published

Products (5)

microsoft/excel 2010 sp2

microsoft/excel 2013 sp1 (2 CPE variants)

microsoft/excel 2016

microsoft/office 2019

microsoft/office_365_proplus

Published Dec 12, 2018

Tracked Since Feb 18, 2026