CVE-2018-0824
Microsoft COM for Windows Deserialization of Untrusted Data Vulnerability
Description
CVE-2018-0824 is a high-severity remote code execution vulnerability in Microsoft COM for Windows with a CVSS v3.1 base score of 8.8. The flaw arises from improper handling of serialized objects by the Microsoft Component Object Model (COM), allowing a remote attacker to execute arbitrary code on a target system when a user opens specially crafted content. CISA added CVE-2018-0824 to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of August 26, 2024, and its ransomware association is classified as unknown. Despite being disclosed in 2018, the EPSS score of 91.52% at the 99.7th percentile confirms that this vulnerability remains one of the most actively exploited in the wild. A public exploit is available on Exploit-DB. The vulnerability affects Windows 7 through Windows 10, Windows Server 2008 through 2016, and Windows RT 8.1.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | - |
| microsoft | windows 10 1607 | - |
| microsoft | windows 10 1703 | - |
| microsoft | windows 10 1709 | - |
| microsoft | windows 10 1803 | - |
| microsoft | windows 7 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 1709 | - |
| microsoft | windows server 1803 | - |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://www.securityfocus.com/bid/104030(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1040848(Broken Link, Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0824(Patch, Vendor Advisory)
- https://www.exploit-db.com/exploits/44906/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0824(US Government Resource)
Weakness Type
Deserialization of Untrusted Data in Microsoft COM
CVE-2018-0824 is a remote code execution vulnerability in the Microsoft Component Object Model (COM) infrastructure caused by improper handling of serialized objects. COM is a foundational Windows technology that enables inter-process communication and object creation across different programming languages and applications. The vulnerability occurs when the COM subsystem deserializes objects from untrusted sources without adequate validation of the object type and content. Deserialization vulnerabilities are particularly dangerous because they can convert passive data into active code execution. When a COM object is deserialized from a malicious source, the attacker-controlled data can specify object types and properties that trigger arbitrary code execution during the deserialization process.
Learn more about deserialization vulnerabilities: CWE-502: Deserialization of Untrusted Data
Impact Analysis
The business impact of CVE-2018-0824 is severe across all three security dimensions. Confidentiality is fully compromised (C:H) because successful exploitation grants the attacker code execution in the context of the user who triggered the deserialization, enabling access to all files, credentials, email, and network resources available to that user. On systems where the COM objects run with elevated privileges, the impact extends to system-level data access.
Integrity faces maximum impact (I:H) as the attacker can install malware, modify system configurations, create backdoor accounts, and tamper with any data the compromised user or service has write access to. The COM infrastructure is deeply integrated into Windows, meaning a compromise can affect multiple applications and services.
Availability is fully at risk (A:H) because arbitrary code execution enables ransomware deployment, system destruction, and denial of service attacks. The network attack vector (AV:N), low complexity (AC:L), and no privileges required (PR:N) make this vulnerability highly accessible to attackers. The user interaction requirement (UI:R) means the victim must open crafted content, but the availability of a public exploit on Exploit-DB and the EPSS score of 91.52% at the 99.7th percentile confirm that this remains a heavily weaponized vulnerability even years after its initial disclosure.
Exploit Maturity
CVE-2018-0824 has reached maximum exploit maturity with confirmed active exploitation, a publicly available exploit, and one of the highest EPSS scores observed. Despite being disclosed in May 2018, CISA added it to the Known Exploited Vulnerabilities catalog in 2024, indicating renewed or ongoing exploitation activity. The EPSS score of 91.52% at the 99.7th percentile places it among the most exploited vulnerabilities ever tracked.
A fully functional exploit is publicly available on Exploit-DB (EDB-44906), providing detailed exploitation code for the COM deserialization vulnerability. Microsoft has issued patches through the MSRC security advisory. The long-lived exploitation of this vulnerability reflects the persistence of unpatched Windows systems in enterprise environments, particularly legacy systems running Windows 7, Windows Server 2008, and Windows 8.1 that may be difficult to update or replace. The ransomware association is classified as unknown, but the reliable remote code execution capability and widespread availability of exploit code make it a versatile tool in attacker arsenals for any post-exploitation objective.
Remediation
-
Apply the May 2018 Microsoft security update immediately. Install the patch from the Microsoft Security Response Center advisory. While this patch has been available since 2018, the continued KEV listing confirms that unpatched systems remain in production. Verify that all Windows systems in the environment have received this update.
-
Identify and patch or isolate legacy Windows systems. The affected products include end-of-life systems such as Windows 7, Windows 8.1, Windows Server 2008, and Windows Server 2012. Inventory all systems running these operating systems and prioritize migration to supported Windows versions. For systems that cannot be immediately upgraded, apply network isolation and enhanced monitoring.
-
Restrict COM object instantiation from untrusted sources. Configure DCOM security settings to limit which COM objects can be instantiated remotely and which users can activate COM objects. Use the Component Services MMC snap-in or Group Policy to restrict DCOM activation permissions and reduce the attack surface.
-
Deploy network-level protections. Configure firewalls and intrusion detection systems to monitor for DCOM traffic (TCP port 135 and dynamic RPC ports) from untrusted sources. Limit DCOM access to trusted network segments and block unnecessary COM/DCOM traffic at network boundaries.
-
Conduct a comprehensive patching audit. The 2024 KEV addition of a 2018 vulnerability signals a patching gap in the environment. Perform a thorough audit of all systems to identify missing security updates, particularly for legacy Windows systems that may have fallen out of regular patch management cycles.
Technical Details
CVE-2018-0824 carries a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, resulting in a high base score of 8.8. The network attack vector (AV:N) enables remote exploitation through crafted content delivery. The low complexity (AC:L) indicates reliable exploitation without special conditions. No privileges (PR:N) are required, but user interaction (UI:R) is needed to trigger the deserialization.
The vulnerability resides in the Microsoft COM (Component Object Model) subsystem's handling of serialized objects. COM uses marshaling and unmarshaling to serialize and deserialize objects for inter-process communication. When a COM object is received from a remote or untrusted source, the COM infrastructure deserializes it by instantiating the specified COM class and populating its properties from the serialized data. CVE-2018-0824 exploits insufficient validation during this deserialization process, allowing an attacker to craft a serialized COM object that, when deserialized, triggers instantiation of dangerous COM classes or manipulation of object properties in ways that lead to arbitrary code execution. The exploit available on Exploit-DB demonstrates how to construct malicious serialized COM objects that achieve code execution when processed by the victim system. The scope is unchanged (S:U), and all three impact metrics are high. Affected systems include Windows 7, Windows 8.1, Windows RT 8.1, Windows 10 (versions 1507 through 1803), and Windows Server 2008 through 2016, as well as Server versions 1709 and 1803.
Frequently Asked Questions
What is CVE-2018-0824?
CVE-2018-0824 is a high-severity remote code execution vulnerability in the Microsoft COM (Component Object Model) subsystem for Windows, caused by improper handling of serialized objects. It allows an attacker to execute arbitrary code when a user opens specially crafted content. It has a CVSS v3.1 score of 8.8.
Why was a 2018 vulnerability added to the KEV catalog in 2024?
CISA added CVE-2018-0824 to the KEV catalog because it continues to be actively exploited in the wild. Many organizations still run legacy Windows systems (Windows 7, Server 2008, Server 2012) that have not been patched. The EPSS score of 91.52% confirms persistent and widespread exploitation activity.
Is there a public exploit for CVE-2018-0824?
Yes, a fully functional exploit is available on Exploit-DB (EDB-44906). This public availability significantly increases the risk, as it enables both sophisticated and less skilled attackers to leverage the vulnerability.
Which Windows versions are affected by CVE-2018-0824?
CVE-2018-0824 affects Windows 7, Windows 8.1, Windows RT 8.1, Windows 10 (versions 1507 through 1803), Windows Server 2008 (including R2), Windows Server 2012 (including R2), Windows Server 2016, and Server versions 1709 and 1803. Most of these are now end-of-life and no longer receive standard security updates.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.