CVE-2018-1003 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Microsoft Windows 10

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer7 documents6 sources
Severity
7.8HIGHNVD
EPSS
29.2%
top 3.41%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
9
Microsoft Windows 10Microsoft Windows 7Microsoft Windows 8.1+6 more
Timeline
PublishedApr 12
Latest updateMay 14

Description

A buffer overflow vulnerability exists in the Microsoft JET Database Engine that could allow remote code execution on an affected system, aka "Microsoft JET Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages11 packages

▶CVEListV5microsoft/windows_server_20084 versions+3
▶CVEListV5microsoft/windows_server_2012(Server Core installation)
▶CVEListV5microsoft/windows_server_2008_r2Itanium-Based Systems Service Pack 1, x64-based Systems Service Pack 1, x64-based Systems Service Pack 1 (Server Core installation)+2
▶CVEListV5microsoft/windows_server_2012_r2(Server Core installation)
▶CVEListV5microsoft/windows_server_2016(Server Core installation)

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-p6qc-jphv-r54h: A buffer overflow vulnerability exists in the Microsoft JET Database Engine that could allow remote code execution on an affected system, aka "Microso↗2022-05-14
▶
CVEList
CVE-2018-1003: A buffer overflow vulnerability exists in the Microsoft JET Database Engine that could allow remote code execution on an affected system, aka "Microso↗2018-04-12
▶

💥Exploits & PoCs

2
Exploit-DB
eMerge E3 1.00-06 - Remote Code Execution↗2019-11-12
▶
Exploit-DB
University Application System 1.0 - SQL Injection / Cross-Site Request Forgery (Add Admin)↗2018-10-30
▶

📋Vendor Advisories

1
Microsoft
Microsoft JET Database Engine Remote Code Execution Vulnerability↗2018-04-10
▶

🕵️Threat Intelligence

1
Fortinet
Microsoft Windows JET Database Engine Heap Overflow Vulnerability↗2018-04-11
▶
CVE-2018-1003 — Microsoft Windows 10 vulnerability | cvebase