A remote code execution vulnerability exists when Skype for Business and Microsoft Lync clients fail to properly sanitize specially crafted…

Published 8 y ago 2018-07-11 · modified 4 mo ago 2026-06-17 · JSON

CVSS

8.8

v3.0 · NVD

CISA KEV

not known exploited

EPSS

16.9%

percentile 97%

Public exploits

none known

A remote code execution vulnerability exists when Skype for Business and Microsoft Lync clients fail to properly sanitize specially crafted content, aka "Remote Code Execution Vulnerability in Skype For Business and Lync." This affects Skype, Microsoft Lync.

Exploit prediction (EPSS)

16.87% probability of exploitation in the next 30 days, higher than 97% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	8.8	`CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`
NVD	2.0	6.8	`AV:N/AC:M/Au:N/C:P/I:P/A:P`

Affected products

Microsoft Skype
Microsoft Microsoft Lync

Classification

Weakness

CWE-20 Improper Input Validation

References

securityfocus.com /bid/104624 · vdb-entry, x_refsource_BID, x_transferred
securitytracker.com /id/1041259 · vdb-entry, x_refsource_SECTRACK, x_transferred
securitytracker.com /id/1041260 · vdb-entry, x_refsource_SECTRACK, x_transferred
portal.msrc.microsoft.com /en-US/security-guidance/advisory/CVE-2018-8311 · x_refsource_CONFIRM, x_transferred

Sources

CVE List: CVE-2018-8311
NVD: CVE-2018-8311

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.