Patch Tuesday, May 2018
Microsoft's monthly security release, Tuesday, May 8, 2018. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
3 CVEs · 0 critical · 3 exploited · 3 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
3 CVEs · 0 critical · 3 exploited · 3 with public exploit code
- 7.5HighMay 9, 2018Microsoft Windows DeserializationCVE-2018-0824Microsoft COM for Windows contains a deserialization of untrusted data vulnerability that allows for privilege escalation and remote code execution via a specially crafted file or script.Exploited73% likelyExploit codeExploit-DB · Metasploit
- 7.5HighMay 9, 2018Microsoft Windows Memory corruptionCVE-2018-8174A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution"Exploited88% likelyExploit codeExploit-DB
- 7.0HighMay 9, 2018Microsoft Win32k Denial of serviceCVE-2018-8120A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory.Exploited73% likelyExploit codeExploit-DB · Metasploit
Adobe
No tracked Adobe CVEs in this window.
SAP
No tracked SAP CVEs in this window.
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.