CVE-2018-8397

—

CVSS 3.0

8.8 high

EPSS

68%p99

Published

Aug 15, 2018 (Aug 15, 2018)

Modified

Jun 17, 2026

Description

A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka "GDI+ Remote Code Execution Vulnerability." This affects Windows Server 2008, Windows 7, Windows Server 2008 R2.

Vendors: microsoft
Products: windows 7, windows server 2008
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (67.9%)

In the news3 stories

August 2018 Microsoft Patch Tuesday fixes two flaws exploited in attacks in the wild

Security AffairsAug 15, 08:40 UTC · Aug 15, 2018Exploit / PoC in the wildCVE-2018-8373 CVE-2018-8414 CVE-2018-8273+5 CVEs

Microsoft Releases Patches for 60 Flaws—Two Under Active Attack

The Hacker NewsAug 15, 00:00 UTC · Aug 15, 2018Vulnerability in the wildCVE-2018-8373 CVE-2018-8414 CVE-2018-8273+5 CVEs

Microsoft Tuesday August 2018

Cisco TalosAug 14, 18:26 UTC · Aug 14, 2018Vulnerability CVE-2018-8273 CVE-2018-8302 CVE-2018-8344+49 CVEs