cbcvebase.
CVE-2018-8176
published 2018-05-23

CVE-2018-8176: A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly validate XML content, aka "Microsoft…

PriorityP260high8.8CVSS 3.0
AVNACLPRNUIRSUCHIHAH
EPSS
22.08%
97.4th percentile
A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly validate XML content, aka "Microsoft PowerPoint Remote Code Execution Vulnerability." This affects Microsoft Office.

Affected

3 ranges
VendorProductVersion rangeFixed in
microsoftmicrosoft_office
microsoftoffice_for_mac
msrcmicrosoft_office_2016_for_mac

Detection & IOCsextracted from sources · hover to see the quote

  • Vulnerability is triggered only after the user opens a specially crafted PowerPoint file AND moves their mouse over a specific location on the page — mouse-hover interaction is required to trigger the exploit
  • The Preview Pane in Windows Explorer / Outlook is NOT an attack vector; detection/triage should focus on files that are fully opened by the PowerPoint application
  • Root cause is improper validation of XML content inside PowerPoint files; inspect PPTX/PPSX/ODP-style XML streams for malformed or unexpected XML structures as a detection signal
  • Attack delivery vectors are email attachment (user convinced to open file) or web-hosted specially crafted file — monitor for PowerPoint files downloaded from the web or received via email that trigger unusual child processes
  • ·Exploit status is 'Publicly Disclosed: Yes' but 'Exploited: No' with 'Exploitation Unlikely' for the latest software release — prioritize patching but in-the-wild exploitation has not been confirmed as of the advisory

CVSS provenance

nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vendor_msrc8.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.