CVE-2018-8558

Severity: medium (CVSS 6.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-11-14 · updated 2026-06-17
Weakness: CWE-200

Description

An information disclosure vulnerability exists when Microsoft Outlook fails to respect "Default link type" settings configured via the SharePoint Online Admin Center, aka "Microsoft Outlook Information Disclosure Vulnerability." This affects Office 365 ProPlus, Microsoft Office. This CVE ID is unique from CVE-2018-8579.

Affected products

Microsoft Office: 2019
Microsoft Office 365 ProPlus: all versions
Microsoft Office: 2019 for 32-bit editions, 2019 for 64-bit editions

References

http://www.securityfocus.com/bid/105826
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8558
http://www.securityfocus.com/bid/105826
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8558

Get alerted when CVE-2018-8558 or the next vulnerability affects your stack