CVE-2018-8429

Microsoft Excel Information Disclosure Vulnerability

CVE-2018-8429 is fixed in 9 products on 1 platform, first by KB4227175, released September 11, 2018. It is not reported as exploited. Patch Radar priority: High.

High
CVSS
n/a
Important
Exploitation
None reported
Exploitation Less Likely
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.1226
96th percentile

<p>An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory. An attacker who exploited the vulnerability could access information previously deleted from the active worksheet.</p> <p>To exploit the vulnerability, an attacker could craft a special document file and then convince the user to open it.</p> <p>The update addresses the vulnerability by changing the way certain Excel functions handle objects in memory.</p>

Where it's fixed

ProductFixed inFixReleased
Microsoft
Microsoft Excel 2010 Service Pack 2 (32-bit editions) KB4227175 Sep 11, 2018
Microsoft Excel 2010 Service Pack 2 (64-bit editions) KB4227175 Sep 11, 2018
Microsoft Excel 2013 RT Service Pack 1 KB4092479 Sep 11, 2018
Microsoft Excel 2013 Service Pack 1 (32-bit editions) KB4092479 Sep 11, 2018
Microsoft Excel 2013 Service Pack 1 (64-bit editions) KB4092479 Sep 11, 2018
Microsoft Excel 2016 (32-bit edition) KB4092460 Sep 11, 2018
Microsoft Excel 2016 (64-bit edition) KB4092460 Sep 11, 2018
Microsoft Excel Viewer 2007 Service Pack 3 KB4092467 Sep 11, 2018
Microsoft Office Compatibility Pack Service Pack 3 KB4092466 Sep 11, 2018