Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-8423: Windows JET Engine lets attackers run code remotely

CVE-2018-8423 · published 8 years ago

Summary

The JET database component in several Windows versions can be tricked into executing malicious programs from a distance. This could let a hacker take control of the affected computer without the user’s knowledge. Install the latest Windows updates and ensure automatic patching is enabled to protect against this risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
microsoft	windows_10	1607 1703 1709 1803 1809 `cpe:2.3:o:microsoft:windows_10:-:::::::*`
microsoft	windows_7	All versions `cpe:2.3:o:microsoft:windows_7:-:sp1::::::`
microsoft	windows_8.1	All versions `cpe:2.3:o:microsoft:windows_8.1::::::::`
microsoft	windows_rt_8.1	All versions `cpe:2.3:o:microsoft:windows_rt_8.1:-:::::::*`
microsoft	windows_server_2008	r2 `cpe:2.3:o:microsoft:windows_server_2008:-:sp2::::::`
microsoft	windows_server_2012	r2 `cpe:2.3:o:microsoft:windows_server_2012:-:::::::*`
microsoft	windows_server_2016	1709 1803 `cpe:2.3:o:microsoft:windows_server_2016:-:::::::*`
microsoft	windows_server_2019	All versions `cpe:2.3:o:microsoft:windows_server_2019:-:::::::*`

Original advisory text

A remote code execution vulnerability exists in the Microsoft JET Database Engine, aka "Microsoft JET Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

References

http://www.securitytracker.com/id/1041837 Third Party Advisory VDB Entry
https://blog.0patch.com/2018/09/outrunning-attackers-on-jet-database.html Exploit Patch Technical Description Third Party Advisory
https://blog.0patch.com/2018/10/patching-re-patching-and-meta-patching.html Exploit Patch Technical Description Third Party Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8423 Patch Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

7.8 High

Exploitation

32% chance of attack within 30 days

Type

CWE-119Buffer Overflow

Timeline

Published10 Oct 2018

Updated29 Sep 2026

First seen29 Sep 2026

Sources

CVE-2018-8423 · NVD

Track software like this

Free during beta