---
id: CVE-2018-0851
title: >-
  Microsoft Office 2007 SP2, Microsoft Office Word Viewer, Microsoft Office 2010
  SP2, Microsoft Office 2013 SP1 and RT SP1, Microsoft Office 2016, and
  Microsoft Office 2016 Click-to-Run (C2R) allow a remote code execution
  vulnerability, du…
summary: >-
  Microsoft Office 2007 SP2, Microsoft Office Word Viewer, Microsoft Office 2010
  SP2, Microsoft Office 2013 SP1 and RT SP1, Microsoft Office 2016, and
  Microsoft Office 2016 Click-to-Run (C2R) allow a remote code execution
  vulnerability, du…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-787
vendor: microsoft
product: office
affected:
  - office = 2007
  - office = 2016
  - office_word_viewer
  - outlook = 2010
  - outlook = 2013
  - outlook = 2016
published: '2018-02-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T18:17:07.267'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2018-0851'
references:
  - url: 'http://www.securityfocus.com/bid/102870'
    label: secure@microsoft.com
  - url: 'http://www.securitytracker.com/id/1040381'
    label: secure@microsoft.com
  - url: >-
      https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0851
    label: secure@microsoft.com
  - url: 'http://www.securityfocus.com/bid/102870'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.securitytracker.com/id/1040381'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0851
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T17:19:39.861959Z'
epss: 0.19111
epssPercentile: 0.97289
ingestedAt: '2026-10-15T18:23:58.391Z'
---

## Overview

Microsoft Office 2007 SP2, Microsoft Office Word Viewer, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1 and RT SP1, Microsoft Office 2016, and Microsoft Office 2016 Click-to-Run (C2R) allow a remote code execution vulnerability, due to how Office handles objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE is unique from CVE-2018-0852.

## Affected

- `office = 2007`
- `office = 2016`
- `office_word_viewer`
- `outlook = 2010`
- `outlook = 2013`
- `outlook = 2016`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.