{"id":"CVE-2018-8174","published":"2018-05-09T19:29:02Z","modified":"2026-08-13T05:17:19Z","title":"Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability","vendor":"Microsoft","product":"Windows","tier":"core","eol":null,"description":{"text":"A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka \"Windows VBScript Engine Remote Code Execution Vulnerability.\" This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an out-of-bounds write in the Windows VBScript Engine, a component of Microsoft Windows, in the way the engine handles objects in memory. An attacker can achieve remote code execution by exploiting this flaw over the network, with no authentication required, but the attack is hard to carry out and requires a user to take an action such as opening a crafted file or visiting a malicious page.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:55:29Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.88243,"percentile":0.99767,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-02-15","dueDate":"2022-08-15","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-8174","provenance":"source"},"vulncheckKev":{"dateAdded":"2018-05-08","exploitedFirstSeen":"2018-05-08","ransomware":true,"evidence":[{"url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2018-May","date":"2018-05-08"},{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2018-05-08"},{"url":"https://www.trendmicro.com/en_us/research/18/g/a-look-into-recent-exploit-kit-activities.html","date":"2018-07-02"},{"url":"https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html","date":"2018-07-31"},{"url":"https://www.group-ib.com/resources/threat-research/silence_moving-into-the-darkside.pdf","date":"2018-09-01"},{"url":"https://unit42.paloaltonetworks.com/unit42-web-based-threats-2018-q2-u-s-remains-1-malicious-web-addresses-china-falls-2-7/","date":"2018-09-05"},{"url":"https://www.bleepingcomputer.com/news/security/hookads-malvertising-installing-malware-via-the-fallout-exploit-kit/","date":"2018-11-13"},{"url":"https://asec.ahnlab.com/en/19056/","date":"2018-11-26"},{"url":"http://download.ahnlab.com/kr/site/library/%5bAnalysis_Report%5dOperation_Kabar_Cobra.pdf","date":"2019-02-21"},{"url":"https://www.recordedfuture.com/blog/top-vulnerabilities-2018","date":"2019-03-19"}],"evidenceTotal":29,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-787","name":"Out-of-bounds Write"}],"references":[{"url":"http://www.securityfocus.com/bid/103998","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://blog.0patch.com/2018/05/a-single-instruction-micropatch-for.html","tags":["Exploit","Technical Description","Third Party Advisory"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8174","tags":["Patch","Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/44741/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/103998","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://blog.0patch.com/2018/05/a-single-instruction-micropatch-for.html","tags":["Exploit","Technical Description","Third Party Advisory"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8174","tags":["Patch","Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/44741/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8174","tags":["US Government Resource"]}],"techniques":[{"id":"T1189","name":"Drive-by Compromise","tactics":["initial-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve","ai-mapping"],"basisDetail":"CTID attack_to_cve (Phase 1); claude-haiku-5-5: Browser-delivered VBScript triggers memory corruption remotely","mappingType":"uncategorized","evidence":[{"from":"description","quote":"remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory","start":2,"end":106}],"confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve","dataset-annotation"],"basisDetail":"CTID attack_to_cve (Phase 1); AnnoCTR expert entity-linking label (train split)","mappingType":"uncategorized","evidence":[{"reportId":"SRC-e691b31be0c8233f6eab","quote":"**VenomKit.** VenomKit is a tool that threat actors can use to craft malicious Rich Text File (RTF) documents that exploit multiple vulnerabilities, including CVE-2017–11882, CVE-2018–0802, and CVE-2018–8174.","start":7733,"end":7941}],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Successful exploitation yields arbitrary code execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory","start":2,"end":106}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1566","name":"Phishing","tactics":["initial-access"],"provenance":"machine","basis":"dataset-annotation","bases":["dataset-annotation"],"basisDetail":"AnnoCTR expert entity-linking label (train split)","mappingType":null,"evidence":[{"reportId":"SRC-e691b31be0c8233f6eab","quote":"**VenomKit.** VenomKit is a tool that threat actors can use to craft malicious Rich Text File (RTF) documents that exploit multiple vulnerabilities, including CVE-2017–11882, CVE-2018–0802, and CVE-2018–8174.","start":7733,"end":7941}],"confidence":"low","confidenceNote":"machine-matched from report text"}],"reports":[{"id":"SRC-e691b31be0c8233f6eab","title":"Golden Chickens: Uncovering a Malware-as-a-Service (MaaS) Provider","publisher":"QuoIntelligence","url":"https://github.com/boschresearch/anno-ctr-lrec-coling-2024/blob/d510b6949e1938d47c93a43eedd562dc538439dc/AnnoCTR/text/train/quoteintelligence_2018-11-29_golden-chickens-uncovering-a-malware.txt","date":"2018-11-29","mentions":[{"quote":"**VenomKit.** VenomKit is a tool that threat actors can use to craft malicious Rich Text File (RTF) documents that exploit multiple vulnerabilities, including CVE-2017–11882, CVE-2018–0802, and CVE-2018–8174.","start":7733,"end":7941}]},{"id":"SRC-7337a86c8549e6b0b5ea","title":"2020 Financial Services and Insurance Industry Threat Report","publisher":"proofpoint.com","url":"https://www.proofpoint.com/sites/default/files/threat-reports/pfpt-au-tr-financial-services-and-insurance.pdf","date":null,"mentions":[{"quote":"k\r\n3k\r\n2k\r\n1k\r\n0\r\nSocial Engineering Office VBA Macro Thread Hijacking PowerShell WMI Keitaro TDS RIG Exploit Kit PDF\r\nXL4 Macro VBS Password Protected Regsvr32 Compressed Executable Geofencing Regsvcs/Regasm\r\nScheduled Task BITS Jobs HTML BlackTDS LCG Kit Executable CVE-2017-11882 JavaJavaScript\r\nCAPTCHA CVE-2018-8174","start":24118,"end":24438},{"quote":"20k\r\n0\r\nOffice VBA Macro Social Engineering PowerShell Thread Hijacking WMI Keitaro TDS RIG Exploit Kit VBS\r\nPDF Geofencing XL4 Macro Regsvr32 Compressed Executable Executable HTML\r\nScheduled Task\r\nBITS Jobs\r\nThreadkit\r\nBlackTDS\r\nLCG Kit\r\nCVE-2014-0515\r\nCVE-2017-11882\r\nJava\r\nPassword Protected\r\nCAPTCHA\r\nCVE-2018-8174","start":27375,"end":27693},{"quote":"0k\r\n100k\r\n0\r\nOffice VBA Macro Social Engineering PowerShell Thread Hijacking WMI Keitaro TDS RIG Exploit Kit VBS\r\nPDFGeofencing XL4 MacroRegsvr32 Compressed Executable\r\nExecutableHTML Scheduled Task\r\nBITS Jobs\r\nThreadkit\r\nBlackTDS\r\nLCG Kit\r\nCVE-2014-0515\r\nCVE-2017-11882\r\nJava\r\nPassword Protected\r\nCAPTCHA\r\nCVE-2018-8174","start":33459,"end":33779}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2018-19844","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-19844","exploited":true,"exploitedSince":"2022-02-15","provenance":"source"},"exploits":[{"id":44741,"url":"https://www.exploit-db.com/exploits/44741","title":"Microsoft Internet Explorer 11 (Windows 7 x86/x64) - vbscript Code Execution","type":"local","platform":"windows","date":"2018-05-21","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2018-05-21"},"pocGithub":{"count":6,"skipped":3,"earliest":"2018-05-22","earliestUrl":"https://github.com/0x09AL/CVE-2018-8174-msf","repos":[{"name":"0x09AL/CVE-2018-8174-msf","url":"https://github.com/0x09AL/CVE-2018-8174-msf","stars":167,"created":"2018-05-22"},{"name":"Yt1g3r/CVE-2018-8174_EXP","url":"https://github.com/Yt1g3r/CVE-2018-8174_EXP","stars":138,"created":"2018-05-30"},{"name":"piotrflorczyk/cve-2018-8174_analysis","url":"https://github.com/piotrflorczyk/cve-2018-8174_analysis","stars":30,"created":"2018-07-10"},{"name":"ruthlezs/ie11_vbscript_exploit","url":"https://github.com/ruthlezs/ie11_vbscript_exploit","stars":9,"created":"2019-05-23"},{"name":"SyFi/CVE-2018-8174","url":"https://github.com/SyFi/CVE-2018-8174","stars":6,"created":"2018-06-01"}]},"first":{"date":"2018-05-21","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/44741"},"provenance":"source"},"exploitRefs":["https://blog.0patch.com/2018/05/a-single-instruction-micropatch-for.html","https://www.exploit-db.com/exploits/44741/"],"flow":[{"stage":"primary","techniques":["T1059"],"provenance":"ai"},{"stage":"related","techniques":["T1189"],"provenance":"source"},{"stage":"related","techniques":["T1203"],"provenance":"source","lowConfidence":true},{"stage":"observed","techniques":["T1566"],"provenance":"machine","lowConfidence":true}],"timeline":[{"date":"2018-05-08","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2018-May","provenance":"source"},{"date":"2018-05-09","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-8174","provenance":"source"},{"date":"2018-05-21","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-44741); later: PoC-in-GitHub 2018-05-22","url":"https://www.exploit-db.com/exploits/44741","provenance":"source"},{"date":"2018-11-29","kind":"report","label":"Named in QuoIntelligence: Golden Chickens: Uncovering a Malware-as-a-Service (MaaS) Provider","url":"https://github.com/boschresearch/anno-ctr-lrec-coling-2024/blob/d510b6949e1938d47c93a43eedd562dc538439dc/AnnoCTR/text/train/quoteintelligence_2018-11-29_golden-chickens-uncovering-a-malware.txt","provenance":"machine"},{"date":"2022-02-15","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-02-15","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-19844","provenance":"source"}],"speed":{"daysToPublicExploit":12,"firstExploitFrom":"Exploit-DB","daysToKev":1378},"priority":{"score":84.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 3096 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.95,"detail":"percentile 0.9977"},{"name":"Named in threat reports","points":6.13,"detail":"2 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 1 Exploit-DB entry; 6 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-windows-cwe-787"}}