CVE-2018-8397

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 67.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-08-15 · updated 2026-06-17

Description

A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka "GDI+ Remote Code Execution Vulnerability." This affects Windows Server 2008, Windows 7, Windows Server 2008 R2.

Affected products

Microsoft Windows 7: all versions
Microsoft Windows Server 2008: r2-sp1

References

http://www.securityfocus.com/bid/104994
http://www.securitytracker.com/id/1041460
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8397
http://www.securityfocus.com/bid/104994
http://www.securitytracker.com/id/1041460
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8397

Get alerted when CVE-2018-8397 or the next vulnerability affects your stack