CVE-2018-0824: Microsoft COM for Windows deserialization remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with confirmed exploitation, a public exploit, high EPSS and a CVSS of 8.8 allowing remote code execution.

What it is

Microsoft COM for Windows fails to properly handle serialized objects, allowing untrusted data deserialization (CWE-502). A crafted serialized object can trigger remote code execution on affected Windows versions, and the flaw is listed in CISA KEV, so it is a confirmed exploited target.

Impact

An attacker can execute arbitrary code in the context of the affected process or user, leading to full compromise of confidentiality, integrity and availability. CVSS 3.1 scores 8.8 (HIGH) with all three impact metrics rated High.

Attack surface

The vector is network-reachable (AV:N) with low complexity and no privileges required, but user interaction is required (UI:R), meaning a victim must open or handle a crafted serialized object. No authentication is needed on the attacker's side.

Exploitation

CVE-2018-0824 is in CISA KEV (added 2024-08-05) and has a public Exploit-DB entry, confirming real-world exploitation. EPSS 30-day probability is 0.73185 (99.4th percentile), indicating high likelihood of attempted exploitation.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2018-0824 on all affected Windows versions.
• If patching cannot be completed immediately, follow CISA KEV required action: apply vendor mitigations or discontinue use of the affected product.
• Restrict handling of untrusted serialized COM objects and block known malicious file types at email and web gateways.
• Enforce least privilege and application allowlisting to limit the impact of code execution if a crafted object is opened.
• Monitor for and remove end-of-life systems such as Windows 7, Windows Server 2008 and Windows Server 2008 R2 that may lack full vendor support.

Detection

• Hunt for processes spawning from COM surrogate or Office applications that then execute scripting engines or unusual child processes.
• Monitor for known Exploit-DB 44906 indicators and related serialized object file names or extensions in email and web traffic.
• Alert on suspicious COM object instantiation events and unexpected CLSID access in endpoint telemetry.
• Correlate Windows event logs for unusual process creation, module loads and network connections from COM-related processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.