CVE-2018-8626 — Out-of-bounds Write in Microsoft Windows 10

CWE-787 — Out-of-bounds Write4 documents4 sources

Severity

9.8CRITICALNVD

EPSS

28.3%

top 3.49%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Microsoft Windows 10 Microsoft Windows 10 Servers Microsoft Windows Server 2012 R2 +3 more

Timeline

PublishedDec 12

Latest updateMay 13

Description

A remote code execution vulnerability exists in Windows Domain Name System (DNS) servers when they fail to properly handle requests, aka "Windows DNS Server Heap Overflow Vulnerability." This affects Windows Server 2012 R2, Windows Server 2019, Windows Server 2016, Windows 10, Windows 10 Servers.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages7 packages

▶CVEListV5microsoft/windows_10_serversversion 1709 (Server Core Installation), version 1803 (Server Core Installation)+1

▶CVEListV5microsoft/windows_server_2016(Server Core installation)

▶CVEListV5microsoft/windows_server_2019(Server Core installation)

▶CVEListV5microsoft/windows_server_2012_r2(Server Core installation)

▶NVDmicrosoft/windowsr2, 1709, 1803+2

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

GHSA

GHSA-r9mj-8p57-hmj9: A remote code execution vulnerability exists in Windows Domain Name System (DNS) servers when they fail to properly handle requests, aka "Windows DNS↗2022-05-13

▶

CVEList

CVE-2018-8626: A remote code execution vulnerability exists in Windows Domain Name System (DNS) servers when they fail to properly handle requests, aka "Windows DNS↗2018-12-12

▶

📋Vendor Advisories

Microsoft

Windows DNS Server Heap Overflow Vulnerability↗2018-12-11

▶