{"id":"CVE-2018-8174","kind":"vulnerability","aliases":["CVE-2018-8174"],"related":[],"title":"Microsoft Windows: Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability","description":"A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka \"Windows VBScript Engine Remote Code Execution Vulnerability.\" This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.","summary":"A memory handling flaw in the Windows VBScript engine lets an attacker run code when a crafted script is processed. It is listed as actively exploited, and the KEV entry notes ransomware use.","severity":"critical","cvss":7.6,"epss":0.88243,"exploited":true,"exploited_at":"2022-02-15T00:00:00+00:00","products":[{"name":"Microsoft Windows","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","internet-explorer","ransomware","vbscript","windows"],"not_affected_if":["patched-windows"],"how_to_check":null,"fix":"Apply the Microsoft update for CVE-2018-8174 per vendor instructions, as CISA requires.","status":"open","published_at":"2018-05-09T19:29:02+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:26:37+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T21:26:37Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft update for CVE-2018-8174 per vendor instructions, as CISA requires.","reach":"internet","impact":"high","summary":"A memory handling flaw in the Windows VBScript engine lets an attacker run code when a crafted script is processed. It is listed as actively exploited, and the KEV entry notes ransomware use.","category":"infrastructure","who_cares":["windows","vbscript","internet-explorer"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs code on the Windows machine via a crafted page or document","analyst_note":"Confirm affected Windows builds and the exact patch KB list from the Microsoft advisory for CVE-2018-8174 and the KEV entry.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["patched-windows"],"user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000452,"input_tokens":2847,"output_tokens":335,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2018':14A,17A '-8174':15A,18A '10':114C,116C '2008':100C,111C '2012':93C,103C '2016':108C '7':90C '8.1':97C,105C 'activ':53B 'affect':88C 'aka':79C 'attack':40B 'bound':10A 'code':42B,64C,84C 'craft':45B 'cve':13A,16A 'engin':6A,37B,74C,82C 'entri':58B 'execut':65C,85C 'exist':67C 'exploit':21B,54B 'explor':25B 'flaw':32B 'handl':31B,75C 'infrastructur':22B 'internet':24B 'internet-explor':23B 'kev':57B 'let':38B 'list':51B 'memori':30B,78C 'microsoft':1A,3A,19A 'note':59B 'object':76C 'out-of-bound':7A 'process':48B 'r2':94C,112C 'ransomwar':26B,60B 'remot':63C,83C 'rt':96C 'run':41B 'script':46B 'server':92C,99C,102C,107C,110C,117C 'use':61B 'vbscript':5A,27B,36B,73C,81C 'vulner':12A,66C,86C 'way':70C 'window':2A,4A,28B,35B,80C,89C,91C,95C,98C,101C,104C,106C,109C,113C,115C 'windows':20A 'write':11A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2018-05-09T19:29:02+00:00","kev":{"dateAdded":"2022-02-15","dueDate":"2022-08-15","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2018-8174","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-8174","severity":null,"published_at":"2022-02-15T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T19:35:25+00:00","note":null},{"source":"epss","external_id":"CVE-2018-8174","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-8174","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2018-8174","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-8174","severity":null,"published_at":"2018-05-09T19:29:02+00:00","modified_at":"2026-08-13T05:17:19+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}