Excel Services CVE-2018-1028

This vulnerability is classified as Code Injection (CWE-94), which allows attackers to inject and execute arbitrary code within the application. A remote code execution vulnerability exists when the Office graphics component improperly handles specially crafted embedded fonts, aka "Microsoft Office Graphics Remote Code Execution Vulnerability." This affects Word, Microsoft Office, Microsoft SharePoint, Excel, Microsoft SharePoint Server. Affected products include: Microsoft Excel Services, Microsoft Office, Microsoft Office 2010, Microsoft Office Web Apps, Microsoft Sharepoint Enterprise Server.