7.5 High Exploited

CVE-2018-0824 Microsoft COM for Windows Deserialization of Untrusted Data Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Ransomware campaigns Not observed so far

Weakness CWE-502

Description

A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Microsoft COM for Windows Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

Affected products and versions

Product	Affected versions	Fixed in
n/a	Versions not published
windows_10	Versions not published
windows_7	Versions not published
windows_8.1	Versions not published
windows_rt_8.1	Versions not published
windows_server_2008	Versions not published
windows_server_2012	Versions not published
windows_server_2016	Versions not published

References

1040848 www.securitytracker.com
44906 www.exploit-db.com
104030 www.securityfocus.com
portal.msrc.microsoft.com portal.msrc.microsoft.com

Timeline

Published May 9, 2018
Added to the KEV catalogue August 5, 2024
Last modified October 21, 2025

The 144658 CVEs of n/a →

CVE-2026-106713 An issue in FreeReels for Android version 2.3.11 allows a remote attacker to obtain sensitive information via the… Not rated CVE-2026-106715 NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin… Not rated CVE-2026-106714 Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it… Not rated CVE-2026-106716 ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep… Not rated

Track this CVE