High severity8.8NVD Advisory· Published Apr 12, 2018· Updated Jun 17, 2026

CVE-2018-1028

Description

A remote code execution vulnerability exists when the Office graphics component improperly handles specially crafted embedded fonts, aka "Microsoft Office Graphics Remote Code Execution Vulnerability." This affects Word, Microsoft Office, Microsoft SharePoint, Excel, Microsoft SharePoint Server.

Affected products

Microsoft/Officellm-fuzzy
Microsoft/Wordllm-fuzzy2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: Automation Services on Microsoft SharePoint Server 2010 Service Pack 2
Microsoft/Excelllm-fuzzy2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: Services on Microsoft SharePoint Enterprise Server 2013 Service Pack 1
Microsoft/Office Visiocpe-rescue
Range: 2010 Service Pack 2 (32-bit editions)
Microsoft/Office SharePointcpe-rescue
Range: Enterprise Server 2016
Microsoft/Sharepoint Servercpe-rescue
Range: 2013 Service Pack 1

Patches

Vulnerability mechanics

References

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-1028nvdPatchVendor Advisory
www.securityfocus.com/bid/103641nvdThird Party AdvisoryVDB Entry
www.securitytracker.com/id/1040654nvdThird Party AdvisoryVDB Entry

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.015
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000