Technical intelligence and weaponization dossier for CVE-2018-8174. Documented exploitation across 1 active malware families totaling 2,992 analyzed telemetry samples.
| Vulnerability ID | CVE-2018-8174 |
|---|---|
| Common Name / Bulletin | Microsoft Windows VBScript Engine Double-Free Remote Code Execution (Microsoft Patch Tuesday) |
| CWE Classification | CWE-415: Double Free in vbscript.dll |
| Affected Software & Versions | Microsoft Windows 7, 8.1, 10, Server 2008 through 2016 |
| Technical Root Cause | Double-free flaw in vbscript.dll when handling class termination routines (Class_Terminate), allowing execution of arbitrary shellcode inside Word or Internet Explorer. |
| Associated ATT&CK Techniques |
Empirical catalog telemetry verifies that the following 1 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:
| Malware Family | Category | Catalog Samples | Operational Profile |
|---|---|---|---|
| gandcrab | Ransomware | 2,992 | GandCrab is a landmark ransomware family that revolutionized the modern cyber extortion industry by pioneering and popularizing the Ransomware-as-a-Service (Raa... |
Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2018-8174 in enterprise networks:
Word documents embedding OLE monikers invoking URL Monikers to fetch remote HTML files with VBScript Class_Terminate handlers.SOC containment checklist and attack surface reduction measures to neutralize exploitation:
For end-to-end incident response procedures, consult our dedicated playbook: Ransomware Containment & Incident Response →