PatchTheCVECVE-2018-0851: Microsoft Office 2007 SP2, Microsoft Office Word Viewer, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1
CVE-2018-0851 is a high-severity flaw (CVSS 8.8) affecting office, office word viewer, outlook. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Microsoft Office 2007 SP2, Microsoft Office Word Viewer, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1 and RT SP1, Microsoft Office 2016, and Microsoft Office 2016 Click-to-Run (C2R) allow a remote code execution vulnerability, due to how Office handles objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE is unique from CVE-2018-0852.
Why this priority
- High severity
- EPSS top 3%: very likely to be exploited
- On your watchlist
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 8.8 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 19.1% (top 3%) |
| CISA exploited list | No |
| Weakness | CWE-787 |
| Published | 2018-02-15 |
| Last modified | 2026-10-15 |
Last updated 2026-10-15 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2018-0851?
office: downgrade or apply the listed mitigation; office word viewer: mitigate or apply the listed mitigation; outlook: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2018-0851 being exploited?
CVE-2018-0851 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2018-0851 affect?
CVE-2018-0851 affects office, office word viewer, outlook. Severity is high (CVSS 8.8). Microsoft Office 2007 SP2, Microsoft Office Word Viewer, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1 and RT SP1, Microsoft Office 2016, and Microsoft Office 2016 Click-to-Run (C2R) allow a remote code execution vulnerability, due t
How urgent is CVE-2018-0851?
Priority 60/100. High severity; EPSS top 3%: very likely to be exploited; On your watchlist
Software pages
Microsoft Office vulnerabilities · Outlook vulnerabilities
Related CVEs
- CVE-2023-36009 MEDIUM 5.5 MITIGATE DOWNGRADE Microsoft Word Information Disclosure Vulnerability
- CVE-2022-34717 HIGH 8.8 MITIGATE DOWNGRADE Microsoft Office Remote Code Execution Vulnerability
- CVE-2026-32190 HIGH 8.4 MITIGATE DOWNGRADE Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
- CVE-2026-32189 HIGH 7.8 MITIGATE DOWNGRADE Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- CVE-2026-32188 HIGH 7.1 MITIGATE DOWNGRADE Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.