Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-0753: Windows 8.1, 10, Server may crash via IPsec

CVE-2018-0753 · published 8 years ago

Summary

Several versions of Windows, including Windows 8.1, Windows 10 and Windows Server, can be forced to stop working if they receive specially crafted network traffic that exploits how IPsec data is stored in memory. This could cause a temporary loss of service for any computer or server running the affected versions. Apply the latest Microsoft security updates or patches to protect your systems.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
microsoft	windows_10	1511 1607 1703 1709 `cpe:2.3:o:microsoft:windows_10:-:::::::*`
microsoft	windows_8.1	All versions `cpe:2.3:o:microsoft:windows_8.1::::::::`
microsoft	windows_rt_8.1	All versions `cpe:2.3:o:microsoft:windows_rt_8.1::::::::`
microsoft	windows_server_2012	r2 `cpe:2.3:o:microsoft:windows_server_2012:-:::::::*`
microsoft	windows_server_2016	1709 `cpe:2.3:o:microsoft:windows_server_2016:-:::::::*`

Original advisory text

Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allow a denial of service vulnerability due to the way objects are handled in memory, aka "Windows IPSec Denial of Service Vulnerability".

References

http://www.securityfocus.com/bid/102361 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1040089 Third Party Advisory VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0753 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

5.9 Medium

Exploitation

9% chance of attack within 30 days

Timeline

Published4 Jan 2018

Updated15 Oct 2026

First seen29 Sep 2026

Sources

CVE-2018-0753 · NVD

Track software like this

Free during beta