CVE-2018-8544: Windows VBScript Engine use-after-free remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityCVSS 8.8 with network reachability, a public exploit and very high EPSS make this a serious risk despite no KEV listing.

What it is

The VBScript engine mishandles objects in memory, a use-after-free (CWE-416) that allows remote code execution. It affects a broad range of Windows client and server releases, so any host still running the legacy VBScript engine is exposed.

Impact

An attacker who gets code to run in the VBScript engine context can execute arbitrary code with the privileges of the invoking user. On a typical workstation that means full user-level control of the machine, and potentially more if the user is privileged.

Attack surface

The CVSS vector is network-reachable with no privileges required, but user interaction is required (UI:R), consistent with a victim opening a crafted document or visiting a malicious page that invokes the VBScript engine. No authentication is needed to deliver the trigger.

Exploitation

Not listed in CISA KEV, but a public Exploit-DB entry exists and EPSS is high (0.476 probability, 98.8th percentile), indicating meaningful real-world exploitation likelihood.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2018-8544 across all affected Windows versions.
• Prioritize patching internet-facing and user-workstation systems, since exploitation requires only user interaction.
• Disable or restrict the VBScript engine where it is not operationally required, and block legacy script execution in browsers and document handlers.
• Enforce attachment and web content controls so untrusted documents and pages cannot reach the VBScript engine.
• Retire unsupported or end-of-life Windows versions that cannot receive the patch.

Detection

• Monitor for unexpected script host or browser processes spawning child processes such as cmd.exe, powershell.exe or wscript.exe.
• Alert on VBScript engine crashes or memory corruption events in Windows Error Reporting tied to script hosts.
• Hunt for documents or web content containing VBScript that arrives from external or untrusted sources.
• Review endpoint telemetry for anomalous process lineage originating from Office, browsers or script hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.