{"id":"CVE-2018-8531","aliases":["EUVD-2018-20155","GHSA-x6h5-845f-rv5f"],"status":"published","title":"A remote code execution vulnerability exists in the way that Azure IoT Hub Device Client SDK...","description":"A remote code execution vulnerability exists in the way that Azure IoT Hub Device Client SDK using MQTT protocol accesses objects in memory, aka \"Azure IoT Device Client SDK Memory Corruption Vulnerability.\" This affects Hub Device Client SDK, Azure IoT Edge.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.15126,"percentile":0.96761,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-787"],"published":"2018-10-10T13:00:00Z","modified":"2026-06-17T02:05:03Z","products":[{"vendor":"microsoft","product":"azure iot edge"},{"vendor":"microsoft","product":"azure_internet_of_things_edge"},{"vendor":"microsoft","product":"csharp_software_development_kit"},{"vendor":"microsoft","product":"hub device client sdk"}],"references":[{"url":"http://www.securityfocus.com/bid/105472","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8531","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-8531"},{"url":"https://github.com/advisories/GHSA-x6h5-845f-rv5f"}],"sources":{"cve":[{"id":"CVE-2018-8531","description":"A remote code execution vulnerability exists in the way that Azure IoT Hub Device Client SDK using MQTT protocol accesses objects in memory, aka \"Azure IoT Device Client SDK Memory Corruption Vulnerability.\" This affects Hub Device Client SDK, Azure IoT Edge.","status":"published","published":"2018-10-10T13:00:00Z","modified":"2024-08-05T07:02:25.102Z","updated_at":"2026-11-02T14:35:03.825765Z"}],"euvd":[{"id":"EUVD-2018-20155","description":"A remote code execution vulnerability exists in the way that Azure IoT Hub Device Client SDK using MQTT protocol accesses objects in memory, aka \"Azure IoT Device Client SDK Memory Corruption Vulnerability.\" This affects Hub Device Client SDK, Azure IoT Edge.","status":"published","published":"2018-10-10T13:00:00Z","modified":"2024-08-05T07:02:25Z","updated_at":"2026-11-03T02:40:02.600498Z"}],"ghsa":[{"id":"GHSA-x6h5-845f-rv5f","title":"A remote code execution vulnerability exists in the way that Azure IoT Hub Device Client SDK...","description":"A remote code execution vulnerability exists in the way that Azure IoT Hub Device Client SDK using MQTT protocol accesses objects in memory, aka \"Azure IoT Device Client SDK Memory Corruption Vulnerability.\" This affects Hub Device Client SDK, Azure IoT Edge.","status":"published","published":"2022-05-13T01:20:57Z","modified":"2023-02-01T05:06:15Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:50:19.669171Z"}],"nvd":[{"id":"CVE-2018-8531","description":"A remote code execution vulnerability exists in the way that Azure IoT Hub Device Client SDK using MQTT protocol accesses objects in memory, aka \"Azure IoT Device Client SDK Memory Corruption Vulnerability.\" This affects Hub Device Client SDK, Azure IoT Edge.","status":"published","published":"2018-10-10T13:29:06.243Z","modified":"2026-06-17T02:05:03.09Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:04:44.873741Z"}]}}