What’s Vulnerable › Vulnerabilities

CVE-2018-8172

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 33.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-07-11 · updated 2026-06-17

Description

A remote code execution vulnerability exists in Visual Studio software when the software does not check the source markup of a file for an unbuilt project, aka "Visual Studio Remote Code Execution Vulnerability." This affects Microsoft Visual Studio, Expression Blend 4.

Affected products

• Microsoft Expression Blend: 2-sp2, 3-sp1, 4-sp3
• Microsoft Visual Studio: 2010-sp1, 2012-update_5, 2013-update_5, 2015-update3
• Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8): 15.7.5
• Microsoft Expression Blend 4: Service Pack 3
• Microsoft Visual Studio: 2010 Service Pack 1, 2012 Update 5, 2013 Update 5, 2015 Update 3, 2017, 2017 Version 15.7.5 (+1)

References

• http://www.securityfocus.com/bid/104616
• http://www.securitytracker.com/id/1041253
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8172
• http://www.securityfocus.com/bid/104616
• http://www.securitytracker.com/id/1041253
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8172

Get alerted when CVE-2018-8172 or the next vulnerability affects your stack