Back

CVE-2018-8421

CRITICAL

A remote code execution vulnerability exists when Microsoft .NET Framework processes untrusted input, aka ".NET Framework Remote Code Execution Vulnerability." This affects Microsoft .NET Framework 4.6, Microsoft .NET Framework 3.5, Microsoft .NET Framework 4.7/4.7.1/4.7.2, Microsoft .NET Framework 3.0, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2, Microsoft .NET Framework 4.7.1/4.7.2, Microsoft .NET Framework 4.7.2, Microsoft .NET Framework 2.0.

Published: Sep 13, 2018 Modified: Jun 17, 2026
CWE-20

CVSS Metrics

CVSSv3
Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: NONE Scope: UNCHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products (23)

Vendor Product Version
microsoft .net_framework 2.0
microsoft .net_framework 3.0
microsoft .net_framework 3.5
microsoft .net_framework 3.5.1
microsoft .net_framework 4.5.2
microsoft .net_framework 4.5.2
microsoft .net_framework 4.6
microsoft .net_framework 4.6.2
microsoft .net_framework 4.7
microsoft .net_framework 4.7.1
microsoft .net_framework 4.7.2
microsoft .net_framework 4.6
microsoft .net_framework 4.6.1
microsoft .net_framework 4.6.2
microsoft .net_framework 4.7
microsoft .net_framework 4.7.1
microsoft .net_framework 4.7.2
microsoft .net_framework 4.7.1
microsoft .net_framework 4.7.2
microsoft .net_framework 4.7.2

…and 3 more

GitHub Security Advisory GHSA-rgxc-r6cp-wvq8

A remote code execution vulnerability exists when Microsoft .NET Framework processes untrusted...

References (6)

Risk Scores

CVSS Score 9.8 / 10
EPSS Score 28.91%

Top 2% most likely to be exploited

Threat Score 47.9 / 100

Data Sources

NVD EPSS GitHub