CVE-2018-0950

—

CVSS 3.0

6.5 medium

EPSS

9%p95

Published

Apr 12, 2018 (Apr 12, 2018)

Modified

Jun 17, 2026

Description

An information disclosure vulnerability exists when Office renders Rich Text Format (RTF) email messages containing OLE objects when a message is opened or previewed, aka "Microsoft Office Information Disclosure Vulnerability." This affects Microsoft Word, Microsoft Office. This CVE ID is unique from CVE-2018-1007.

Vendors: microsoft
Products: office, office compatibility pack, word
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (9.1%)

In the news3 stories

Microsoft Patch Tuesday

Cisco TalosApr 10, 20:13 UTC · Apr 10, 2018Vulnerability CVE-2018-0870 CVE-2018-0959 CVE-2018-0979+43 CVEs

CVE-2018-0950 flaw in Microsoft Outlook could be exploited to steal Windows Passwords

Security AffairsApr 12, 16:31 UTC · Apr 12, 2018Vulnerability CVE-2018-0950

Flaw in Microsoft Outlook Lets Hackers Easily Steal Your Windows Password

The Hacker NewsApr 12, 07:29 UTC · Apr 12, 2018Vulnerability CVE-2018-0950