← Vulnerability feed

Vulnerability record · CVE-2018-8311 · published 11 July 2018

CVE-2018-8311: Microsoft lync improper input validation vulnerability

Microsoft · Lync

A remote code execution vulnerability exists when Skype for Business and Microsoft Lync clients fail to properly sanitize specially crafted content, aka "Remote Code Execution Vulnerability in Skype For Business and Lync." This affects Skype, Microsoft Lync.

8.8 CVSS 3.0 High EPSS 16% · top 3.1% CWE-20 · Improper input validation
8.8CVSS 3.0 base score, v2 6.8
16%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
8References
17 Jun 2026Last modified by NVD

Description

A remote code execution vulnerability exists when Skype for Business and Microsoft Lync clients fail to properly sanitize specially crafted content, aka "Remote Code Execution Vulnerability in Skype For Business and Lync." This affects Skype, Microsoft Lync.

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.securityfocus.com/bid/104624 Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1041259 Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1041260 Third Party AdvisoryVDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8311 Vendor Advisory
http://www.securityfocus.com/bid/104624 Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1041259 Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1041260 Third Party AdvisoryVDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8311 Vendor Advisory

Track CVE-2018-8311 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2015-1671Microsoft DirectWrite TrueType Font Parsing Remote Code ExecutionThe Windows DirectWrite library fails to properly handle crafted TrueType fonts, allowing memory corruption that can lead to arbitrary code execution…KEVEPSS 49%analysed7.8CVE-2013-3906Microsoft GDI+ TIFF parsing code execution via crafted imageGDI+ in multiple Microsoft products fails to properly handle crafted TIFF images, allowing memory corruption that leads to arbitrary code execution. …KEVEPSS 85%analysed9.8CVE-2020-1025Microsoft lync improper input validation vulnerabilityAn elevation of privilege vulnerability exists when Microsoft SharePoint Server and Skype for Business Server improperly handle OAuth token validatio…EPSS 5.9%9.8CVE-2016-7182Microsoft live meeting improper input validation vulnerabilityThe Graphics component in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R…EPSS 30%9.3CVE-2015-6108Microsoft live meeting memory buffer overflow vulnerabilityThe Windows font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8; Windows 8.1; Windows Server 20…EPSS 26%9.3CVE-2015-6107Microsoft live meeting memory buffer overflow vulnerabilityThe Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 20…EPSS 18%9.3CVE-2015-6106Microsoft live meeting memory buffer overflow vulnerabilityThe Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2, Office 2007 SP3, Office 2010 SP2, Word Viewer, Skype for Business 2…EPSS 17%9.3CVE-2015-2503Microsoft access permissions and access controls vulnerabilityMicrosoft Access 2007 SP3, Excel 2007 SP3, InfoPath 2007 SP3, OneNote 2007 SP3, PowerPoint 2007 SP3, Project 2007 SP3, Publisher 2007 SP3, Visio 2007…EPSS 17%

Source: NIST National Vulnerability Database (record CVE-2018-8311), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.