Actively exploited in the wild

Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability

Microsoft - Windows · Listed in the CISA KEV since 2022-02-15. This indicates confirmed attacks in production environments.

Required action: Apply updates per vendor instructions.

CVE-2018-8174

HighCVSS 7.5KEV

Published: 09/05/2018(UTC)Updated: 13/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

87.64%

100th percentile - higher than 100% of all known CVEs

Summary

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Remote Code Execution Vulnerability.' This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

Risk Assessment

An attacker can exploit this vulnerability to execute arbitrary code in the context of the current user, potentially leading to system compromise.

Recommendation

Install available security updates from Microsoft for affected Windows systems.

Original NVD description (English source)

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.