CVE-2018-8174: Windows VBScript Engine Out-of-Bounds Write RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is in the CISA KEV catalog with known ransomware use, has a very high EPSS score, and public exploits exist, so unpatched systems face active exploitation risk.

What it is

The Windows VBScript engine mishandles objects in memory, causing an out-of-bounds write (CWE-787) that can corrupt memory and lead to remote code execution. It affects a broad set of Windows client and server versions, and because VBScript is reachable through browsers and documents, it is a practical target for drive-by and document-based attacks.

Impact

An attacker who triggers the flaw can execute arbitrary code in the context of the affected process, typically the logged-on user, giving full control of the host. This includes installing programs, changing or deleting data, and creating accounts with full user rights.

Attack surface

Reached over the network (AV:N) with no privileges required (PR:N), but exploitation requires user interaction (UI:R), such as visiting a crafted page or opening a malicious document that invokes the VBScript engine. Attack complexity is rated high (AC:H), reflecting the memory-corruption work needed for reliable code execution.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2022-02-15 with a 2022-08-15 remediation due date and flags known ransomware campaign use. EPSS is very high (0.88332, 99.762 percentile), and public references include Exploit-DB and a technical micro-patch writeup, indicating mature public exploitation.

What to do

• Apply the Microsoft security update for CVE-2018-8174 on all affected Windows versions as the first action.
• Disable or restrict VBScript execution where it is not required, and block legacy script engine use in browsers and document handlers.
• Enforce attachment and web content controls so untrusted documents and pages cannot invoke the VBScript engine.
• Prioritize remediation on internet-facing and user-workstation systems, and verify patch state against the CISA KEV due date.
• Monitor for and remove unsupported or end-of-life Windows systems that cannot receive the patch.

Detection

• Hunt for processes such as wscript.exe, cscript.exe, or browser processes spawning script engines or unexpected child processes.
• Monitor for Office or browser processes loading VBScript-related modules and for anomalous memory-corruption crash patterns.
• Review endpoint and network telemetry for known exploit artifacts tied to public PoCs and the referenced Exploit-DB entry.
• Alert on execution of VBScript from temporary or user-writable directories and on suspicious script file creation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.