CVE-2018-0598

Exploitation likely. EPSS gives it a 10% chance of exploitation in the next 30 days. No fix published yet.

CVSS 3.17.8High EPSS percentile96th10% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2018-06-26Updated 2024-11-21Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Microsoft Self-extracting archive files created by IExpress bundled with Microsoft WindowsAffected: unspecifiedUpgrade to: not statedStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your business uses or distributes self-extracting installers created with Windows IExpress (common in custom software packaging tools).
Avoid running self-extracting executables downloaded from untrusted sources or copied with other files into the same folder.
Keep Windows fully updated through normal Windows Update, since no specific patch version is confirmed in current records — ask your IT provider to verify the latest security rollup addresses this.
If you build and distribute your own installers with IExpress, rebuild them in a clean, isolated folder with no extra files present, and distribute the full package as a single file (e.g., via a signed installer) rather than loose folders.

May need vendor or contractor work

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Untrusted search path vulnerability in Self-extracting archive files created by IExpress bundled with Microsoft Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

In plain language

Written by AI from the record

This is an old Windows flaw where a trick file placed next to a self-extracting installer can let an attacker sneak in malicious code when someone runs that installer; it's not something attackers are actively exploiting right now, but no official fix information is on record, so it's worth a quick check rather than a panic.

Untrusted search path (DLL hijacking) vulnerability in self-extracting archives generated by Windows' IExpress tool allows local privilege escalation when a victim executes a bundle alongside an attacker-planted malicious DLL, requiring user interaction and no confirmed in-the-wild exploitation.

If you're affected

Full system takeover on affected PC
Malware installed via trusted-looking installer
Privilege escalation to admin
Supply-chain style tampering of installers

What is it

Think of a self-extracting installer like a sealed moving box labeled 'open me to unpack.' This flaw means someone could slip a fake, dangerous item into the same room as the box, and when you open it, the fake item gets used instead of the real one — giving an attacker control over your computer. It only works if someone actually runs the installer while the planted file is sitting nearby.

Who is affected

This matters to you if your business creates, distributes, or regularly runs self-extracting installer files (.exe bundles) built with the Windows IExpress tool — a feature built into Microsoft Windows itself. It's only a real risk if someone can place a malicious file in the same folder as the installer and then convince a user to run it, so isolated, carefully-distributed installers are much lower risk.

How urgent is it

There is no evidence attackers are exploiting this right now, and no public attack tool has been published, so this does not demand emergency action. Press attention to this issue is rising, and because no clear patch information is on record, it deserves a deliberate check and cleanup of how your installers are built and distributed rather than being ignored.

What to do — in detail

Confirm exposure: inventory any self-extracting (.exe) packages your organization builds via IExpress or similar Windows packaging tools, and check whether these are distributed in environments where an attacker could plant a file in the same directory (shared drives, email attachments bundled with other files, download mirrors).
Patch status: no fix/patch version is currently documented in available records for this CVE — track Microsoft's Security Update Guide and monthly Windows Update rollups for CVE-2018-0598 coverage, and escalate to Microsoft support if no confirmation exists.
Workaround while unpatched: build and distribute IExpress bundles from a clean, single-use temp directory; sign installers digitally and instruct users to verify signatures before execution; avoid extracting self-extracting archives into directories containing unknown or downloaded DLLs.
Not in CISA KEV and no CISA-mandated remediation date applies; treat this as a standard patch-management item, not an emergency deadline.
Monitor: watch for any DLL-load anomalies or unexpected process launches tied to IExpress-generated executables via endpoint detection, and track vendor advisories/press coverage given the currently rising attention on this CVE.

Technical context

CVSS 3.1 score 7.8 (High), vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H — local attack vector requiring user interaction but no privileges, with high impact to confidentiality, integrity, and availability upon successful exploitation. Weakness class is CWE-426 (Untrusted Search Path), i.e., classic DLL hijacking: the IExpress self-extraction routine loads a DLL by name without specifying a fully-qualified/trusted path, allowing a maliciously-named DLL in the working directory to be loaded instead. Not listed in CISA's Known Exploited Vulnerabilities catalog, and no public exploit code is currently on record. EPSS predicts a low likelihood of near-term exploitation (10th percentile range, flat trend) — consistent with no confirmed in-the-wild activity. No patch/fix information is currently available in tracked sources, despite rising press/pulse attention, which warrants monitoring for an eventual Microsoft advisory update.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS96th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

10% chance of exploitation activity in the next 30 days, which ranks it in the 96th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

8 events over 3020 days, from the signal feeds we watch.

2026-10-02EPSS band changelow → moderateepss band change
2026-06-25OpenVAS check added
2026-06-22EPSS band changemoderate → low
2024-11-21Record updated
2018-06-26Publishedweakness classified, att&ck mapped

Affected products

Microsoftcommercial · US
- Self-extracting archive files created by IExpress bundled with Microsoft WindowsOperating Systems / windows
- windowsOSOperating Systems / windows

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable