CVE-2018-8174

What is the Windows VBScript Engine?

The VBScript engine is a legacy Windows component that interprets VBScript code, historically used both for local automation and, critically, embeddable inside Office documents and Internet Explorer/webpages via ActiveX controls. Even after VBScript's active use declined, the engine remained present on nearly every Windows installation and reachable through Office's ability to host an IE-based browser control, giving attackers a long-lived, high-value bridge from a malicious document into a memory-unsafe scripting engine.

Overview

CVE-2018-8174, widely known by the nickname "Double Kill," is a remote code execution vulnerability caused by an out-of-bounds write when the VBScript engine handles objects in memory (aka "Windows VBScript Engine Remote Code Execution"). It was discovered being actively exploited in the wild as a zero-day in April 2018, delivered via malicious Microsoft Office documents that embedded an OLE object which loaded Internet Explorer's scripting engine to run attacker-controlled VBScript — despite the victim never directly opening a browser. This made it exploitable through Office documents even against users who never used Internet Explorer as their primary browser.

Technical Details

The flaw is a CWE-787 (Out-of-Bounds Write) use-after-free-style condition in how the VBScript engine manages memory for script objects. A crafted script can force the engine into a state where a freed object is reused, giving the attacker a controlled memory corruption primitive that can be leveraged into arbitrary code execution in the context of the user running the document or webpage. Because it required a user to open a malicious document or webpage (user interaction: Required) but no authentication, it was well suited to spear-phishing delivery.

Discovery

The zero-day was discovered in the wild by researchers at Qihoo 360's Core Security team (360 Threat Intelligence Center) in April 2018, who observed it being used in a targeted attack before reporting it to Microsoft.

Exploitation Context

Double Kill was used in real-world targeted intrusion campaigns before Microsoft's patch was available, and technical detail and proof-of-concept code circulated widely once details became public, leading to broader adoption by exploit kit developers and additional threat actors. CISA added CVE-2018-8174 to the KEV catalog in February 2022, and the entry notes confirmed use in ransomware operations as well.

Remediation

1. Apply the May 2018 Windows security update (or later cumulative update) addressing CVE-2018-8174.
2. Disable VBScript execution where feasible — Microsoft has separately provided guidance and later default changes to restrict legacy VBScript in Internet Explorer/Office contexts.
3. Restrict or disable OLE object execution in Microsoft Office via Protected View and Group Policy to reduce the document-based delivery vector.
4. Maintain up-to-date email and endpoint protection capable of detecting malicious Office documents that embed OLE/ActiveX-triggered scripting exploits.
5. Educate users on the risks of enabling editing/content on unsolicited Office documents, since this and similar VBScript-engine bugs are most commonly delivered via phishing.