CVE-2018-8256

Description

A remote code execution vulnerability exists when PowerShell improperly handles specially crafted files, aka "Microsoft PowerShell Remote Code Execution Vulnerability." This affects Windows RT 8.1, PowerShell Core 6.0, Microsoft.PowerShell.Archive 1.2.2.0, Windows Server 2016, Windows Server 2012, Windows Server 2008 R2, Windows Server 2019, Windows 7, Windows Server 2012 R2, PowerShell Core 6.1, Windows 10 Servers, Windows 10, Windows 8.1.

8.8

CVSS

Severity: High

CVSS 3.0 •

CVSS 2.0 •

EPSS 17.36% Top 10%

Vendor Advisory microsoft.com

Affected: Microsoft Windows 7

Affected: Microsoft Microsoft.PowerShell.Archive

Affected: Microsoft Windows 10 Servers

Affected: Microsoft Windows Server 2012 R2

Affected: Microsoft Windows RT 8.1

Affected: Microsoft Windows Server 2008 R2

Affected: Microsoft Windows Server 2012

Affected: Microsoft PowerShell Core

Affected: Microsoft Windows Server 2016

Affected: Microsoft Windows 8.1

Affected: Microsoft Windows 10

Affected: Microsoft Windows Server 2019

References

Link	Tags
http://www.securitytracker.com/id/1042108	third party advisory vdb entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8256	patch vendor advisory
http://www.securityfocus.com/bid/105781	third party advisory vdb entry

Frequently Asked Questions

What is the severity of CVE-2018-8256?: CVE-2018-8256 has been scored as a high severity vulnerability.
How to fix CVE-2018-8256?: To fix CVE-2018-8256, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2018-8256 being actively exploited in the wild?: It is possible that CVE-2018-8256 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~17% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2018-8256?: CVE-2018-8256 affects Microsoft Windows 7, Microsoft Microsoft.PowerShell.Archive, Microsoft Windows 10 Servers, Microsoft Windows Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Windows Server 2008 R2, Microsoft Windows Server 2012, Microsoft PowerShell Core, Microsoft Windows Server 2016, Microsoft Windows 8.1, Microsoft Windows 10, Microsoft Windows Server 2019.