Microsoft Office 2007 SP2, Microsoft Office Word Viewer, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1 and RT SP1, Microsoft Office 2016, and Microsoft Office 2016 Click-to-Run (C2R) allow a remote code execution vulnerability, due to how Office handles objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE is unique from CVE-2018-0852.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0851 Patch, Vendor Advisory
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0851 Patch, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 8.8 · microsoftNVD modified 2026-10-15 18:17
Affected (CPE criteria) 8
cpe:2.3:a:microsoft:office:2007:*:*:*:*:*:*:*cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:*:*cpe:2.3:a:microsoft:office:2016:*:*:*:click-to-run:*:*:*cpe:2.3:a:microsoft:office_word_viewer:-:*:*:*:*:*:*:*cpe:2.3:a:microsoft:outlook:2010:sp2:*:*:*:*:*:*cpe:2.3:a:microsoft:outlook:2013:sp1:*:*:*:*:*:*cpe:2.3:a:microsoft:outlook:2013:sp1:*:*:*:rt:*:*cpe:2.3:a:microsoft:outlook:2016:*:*:*:*:*:*:*
References 6
- http://www.securityfocus.com/bid/102870 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1040381 Third Party Advisory, VDB Entry
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0851 Patch, Vendor Advisory
- http://www.securityfocus.com/bid/102870 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1040381 Third Party Advisory, VDB Entry
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0851 Patch, Vendor Advisory