Netskope Threat Labs

FILE-OTHER Microsoft Windows malformed .themepack Theme API remote code execution attempt

IPS-CFW

1 SID: 48059

Description

Detects a theme pack exploiting CVE-2018-8413, a flaw in the Windows theme processing that can allow code execution. The rule matches the traversal sequences that point the theme parser at operator-controlled files.

CVEs

CVE-2018-8413

Related malware families

Microsoft

References