CVE-2018-8474

HIGH ⚠ Exploit

A security feature bypass vulnerability exists when Lync for Mac 2011 fails to properly sanitize specially crafted messages, aka "Lync for Mac 2011 Security Feature Bypass Vulnerability." This affe...

Affects 1 product across 1 vendor.

CVSS 3.07.5
EPSS38.2%
Percentile99th
PatchPatched
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, no confidentiality impact, full integrity impact, no availability impact.
CWE Weakness Definitions
CWE-20: Improper Input Validation

Software does not validate or incorrectly validates input, allowing attackers to craft data processed in unintended ways.

Related Attack Patterns (CAPEC)
CAPEC-3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters
via CWE-20
CAPEC-7 Blind SQL Injection
via CWE-20
CAPEC-8 Buffer Overflow in an API Call
via CWE-20
CAPEC-9 Buffer Overflow in Local Command-Line Utilities
via CWE-20
CAPEC-10 Buffer Overflow via Environment Variables
via CWE-20
Show all 51
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A security feature bypass vulnerability in Lync for Mac 2011 allows attackers to exploit improperly sanitized messages, potentially leading to unauthorized access or other malicious activities.

BSID: BS-2018-GLOBAL-170560-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2018-8474?
A security feature bypass vulnerability in Lync for Mac 2011 allows attackers to exploit improperly sanitized messages, potentially leading to unauthorized access or other malicious activities.
What is the CVSS score for CVE-2018-8474?
CVE-2018-8474 has CVSS 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS: 38.2%.
Is CVE-2018-8474 actively exploited?
Public exploit available for CVE-2018-8474. Exploitation risk elevated.
How do I remediate CVE-2018-8474?
Priority: MEDIUM. Advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8474 PSIRT: [email protected]
What systems are affected by CVE-2018-8474?
CVE-2018-8474 affects Microsoft Lync For Mac.
Vulnerability Details
CVE IDCVE-2018-8474
BSIDBS-2018-GLOBAL-170560-H BreachSpider Global ID
CVSS VectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Published2018-09-13
Last Modified2024-11-21
ICS Relevance0%
Weakness (CWE)
Improper Input Validation
SourceNVD
Official Description

A security feature bypass vulnerability exists when Lync for Mac 2011 fails to properly sanitize specially crafted messages, aka "Lync for Mac 2011 Security Feature Bypass Vulnerability." This affects Microsoft Lync.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability arises from Lync for Mac 2011's failure to correctly sanitize specially crafted messages, which can be exploited to bypass security features.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Microsoft Lync For Mac 2011
Remediation
View Vendor Advisory →

Remediation Priority: MEDIUM

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 2955 Days
CISA known-exploitedNot in KEV catalog
Public Exploit⚠ Available — Reference
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceMEDIUM
Enriched At2026-05-24
Related CVEs affecting Microsoft
CVE-2026-48331 10.0 Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SS... CVE-2007-1644 10.0 The dynamic DNS update mechanism in the DNS Server service on Microsoft Windo... CVE-2009-2532 10.0 Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold and SP2,... CVE-2012-0772 10.0 An unspecified ActiveX control in Adobe Flash Player before 10.3.183.18 and 1... CVE-2011-1300 10.0 The Program::getActiveUniformMaxLength function in libGLESv2/Program.cpp in l...
View all Microsoft CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →