Read the docs
TI-2018-06114 Aliases CVE-2018-8432GHSA-w9fx-69v3-2jgx

A remote code execution vulnerability exists in the way that Microsoft Graphics…

Priority MEDIUM 52Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka "Microsoft Graphics Components Remote Code Execution Vulnerability." This affects Windows 7, Microsoft Office, Microsoft Office Word Viewer, Office 365 ProPlus, Microsoft Excel Viewer, Microsoft PowerPoint Viewer, Windows Server 2019, Windows Server 2008 R2, Windows 10, Windows Server 2008.

Why it matters now

EPSS 0.19546 97th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftWindows 732-bit Systems Service Pack 1; x64-based Systems Service Pack 1—No fix listedCNA
MicrosoftMicrosoft Office2016 for Mac; 2019 for 32-bit editions; 2019 for 64-bit editions; Compatibility Pack Service Pack 3—No fix listedCNA
MicrosoftMicrosoft Office Word ViewerMicrosoft Office Word Viewer—No fix listedCNA
MicrosoftMicrosoft Excel Viewer2007 Service Pack 3—No fix listedCNA
MicrosoftMicrosoft PowerPoint Viewer2007—No fix listedCNA
MicrosoftWindows Server 2019(Server Core installation)—No fix listedCNA
MicrosoftOffice365 ProPlus for 32-bit Systems; 365 ProPlus for 64-bit Systems—No fix listedCNA
MicrosoftWindows Server 2008 R2Itanium-Based Systems Service Pack 1; x64-based Systems Service Pack 1; x64-based Systems Service Pack 1 (Server Core installation)—No fix listedCNA
MicrosoftWindows 10Version 1809 for 32-bit Systems; Version 1809 for x64-based Systems—No fix listedCNA
MicrosoftWindows Server 200832-bit Systems Service Pack 2; 32-bit Systems Service Pack 2 (Server Core installation); Itanium-Based Systems Service Pack 2; x64-based Systems Service Pack 2; x64-based Systems Service Pack 2 (Server Core installation)—No fix listedCNA
  • Windows 7 VendorMicrosoft Affected 32-bit Systems Service Pack 1; x64-based Systems Service Pack 1 Fixed in — No fix listed CNA
  • Microsoft Office VendorMicrosoft Affected 2016 for Mac; 2019 for 32-bit editions; 2019 for 64-bit editions; Compatibility Pack Service Pack 3 Fixed in — No fix listed CNA
  • Microsoft Office Word Viewer VendorMicrosoft Affected Microsoft Office Word Viewer Fixed in — No fix listed CNA
  • Microsoft Excel Viewer VendorMicrosoft Affected 2007 Service Pack 3 Fixed in — No fix listed CNA
  • Microsoft PowerPoint Viewer VendorMicrosoft Affected 2007 Fixed in — No fix listed CNA
  • Windows Server 2019 VendorMicrosoft Affected (Server Core installation) Fixed in — No fix listed CNA
  • Office VendorMicrosoft Affected 365 ProPlus for 32-bit Systems; 365 ProPlus for 64-bit Systems Fixed in — No fix listed CNA
  • Windows Server 2008 R2 VendorMicrosoft Affected Itanium-Based Systems Service Pack 1; x64-based Systems Service Pack 1; x64-based Systems Service Pack 1 (Server Core installation) Fixed in — No fix listed CNA
  • Windows 10 VendorMicrosoft Affected Version 1809 for 32-bit Systems; Version 1809 for x64-based Systems Fixed in — No fix listed CNA
  • Windows Server 2008 VendorMicrosoft Affected 32-bit Systems Service Pack 2; 32-bit Systems Service Pack 2 (Server Core installation); Itanium-Based Systems Service Pack 2; x64-based Systems Service Pack 2; x64-based Systems Service Pack 2 (Server Core installation) Fixed in — No fix listed CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:excel_viewer:2007:sp3:*:*:*:*:*:*2007 sp3VulnerableMicrosoft
cpe:2.3:a:microsoft:office:2016:*:mac_os:*:*:*:*:*2016VulnerableMicrosoft
cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:*:*2019VulnerableMicrosoft
cpe:2.3:a:microsoft:office_365_proplus:-:*:*:*:*:*:*:*not specified by NVDVulnerableMicrosoft
cpe:2.3:a:microsoft:office_compatibility_pack:-:sp3:*:*:*:*:*:*not specified by NVDVulnerableMicrosoft
cpe:2.3:a:microsoft:powerpoint_viewer:2007:*:*:*:*:*:*:*2007VulnerableMicrosoft
cpe:2.3:a:microsoft:word_viewer:-:*:*:*:*:*:*:*not specified by NVDVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:*1809VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*not specified by NVDVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*not specified by NVDVulnerableMicrosoft
  • cpe:2.3:a:microsoft:excel_viewer:2007:sp3:*:*:*:*:*:* Versions 2007 sp3 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:office:2016:*:mac_os:*:*:*:*:* Versions 2016 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:*:* Versions 2019 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:office_365_proplus:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:office_compatibility_pack:-:sp3:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:powerpoint_viewer:2007:*:*:*:*:*:*:* Versions 2007 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:word_viewer:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:* Versions 1809 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*r2 sp1VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*not specified by NVDVulnerableMicrosoft
  • cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:* Versions r2 sp1 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-8432
  2. 2026-10-03 Alias added: GHSA-w9fx-69v3-2jgx

References

Patch 1

  • TI-2019-00335 Command injection in Microsoft Office KEVCVSS 3.1HIGH 8.8
  • TI-2015-02130 Microsoft PowerPoint 2007 SP3, Word 2007 SP3, PowerPoint 2010 SP2, Word 2010 SP2… KEVCVSS 3.1HIGH 8.8
  • TI-2009-00222 Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold… KEVCVSS 3.1HIGH 8.8
  • TI-2007-00655 Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and… KEVCVSS 3.1HIGH 8.8
  • TI-2016-06250 Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016… KEVCVSS 3.1HIGH 7.8
  • TI-2013-03410 GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and… KEVCVSS 3.1HIGH 7.8
See all 124 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences