Which products and versions are affected by CVE-2018-8413?

Affected: Windows 10 (Microsoft) versions 1607, 1703, 1709, 1803, 1809, >= 32-bit Systems; Windows 7 (Microsoft) versions >= 32-bit Systems Service Pack 1; Windows 8.1 (Microsoft) versions >= 32-bit systems, among others. The full list is in the CVE brief.

Is CVE-2018-8413 being exploited in the wild?

It is not listed in any known-exploited vulnerabilities catalog.

Is CVE-2018-8413 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2018-8413?

Public exploit code is available.

Is there a fix for CVE-2018-8413?

No fixed version is listed yet; check the vendor advisory for mitigations.

How urgently should CVE-2018-8413 be patched?

Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.

Request A Demo

WatchlistHigh

CVE-2018-8413Windows 10 Vulnerability

A remote code execution vulnerability exists when "Windows Theme API" does not properly decompress files, aka "Windows Theme API Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2019, Windows Server 2012,…

Published Oct 10, 2018 · Updated Nov 21, 2024

Key Facts

Patch immediately

CVE-2018-8413 is a high-severity vulnerability (CVSS 7.8 v3) affecting Windows 10 (Microsoft), Windows 7 (Microsoft), Windows 8.1 (Microsoft) and 8 more products.
It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
EPSS estimates a 46% probability of exploitation in the next 30 days.
No fixed version is listed yet; check the vendor advisory for mitigations.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.

Scores

CVSS v3

7.8

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

46%

Higher than 98.8% of all scored CVEs

Exploit maturity

Proof of concept

ATLAS score

41/100

Publication score, see How it works

Exploitation Verdict

KEV listed

Not listed

Federal due date

None

No federal due date

Ransomware use

Not reported

Attributed actors

None named

Exploit & Defence Guidance

Exploit maturity

Proof of concept

Public exploit code

Proof-of-concept links

In-the-wild evidence

Reports of active use

Advisories And Exploit References

advisory105448
advisory1041824
patchhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8413

Description

Affected Products

26 affected entries in total

Product	Affected versions	Fixed in
Windows 10Microsoft	1607, 1703, 1709, 1803, 1809, >= 32-bit Systems	n/a
Windows 7Microsoft	>= 32-bit Systems Service Pack 1	n/a
Windows 8.1Microsoft	>= 32-bit systems	n/a
Windows RT 8.1Microsoft	>= Windows RT 8.1	n/a
Windows Server 2008Microsoft	r2-sp1	n/a

6 more affected products in the full CVE brief

Timeline

Publicly disclosed
Oct 10, 2018
Last updated
Nov 21, 2024

References

advisory105448
advisory1041824
patchportal.msrc.microsoft.com · CVE-2018-8413
exploitExploitDB-47975
otherpacketstormsecurity.com · Microsoft-Windows-Theme-API-File-Parsing.html

FAQ

Common Questions.

A remote code execution vulnerability exists when "Windows Theme API" does not properly decompress files, aka "Windows Theme API Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Serv…
Affected: Windows 10 (Microsoft) versions 1607, 1703, 1709, 1803, 1809, >= 32-bit Systems; Windows 7 (Microsoft) versions >= 32-bit Systems Service Pack 1; Windows 8.1 (Microsoft) versions >= 32-bit systems, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
No fixed version is listed yet; check the vendor advisory for mitigations.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.

Is CVE-2018-8413 On Your Attack Surface?

Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.