CVE-2018-8482 [Low] | Information Disclosure in Windows 10

An information disclosure vulnerability exists when Windows Media Player improperly discloses file information, aka "Windows Media Player Information Disclosure Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8481.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-06-15	15.61%	5.14%	-10.47%
2	2026-04-26	12.19%	15.61%	+3.42%
3	2026-03-28	—	12.19%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-06-15

15.61%

5.14%

-10.47%

2026-04-26

12.19%

15.61%

+3.42%

2026-03-28

—

12.19%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
3.1	3.0	LOW	`CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:H) Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:R) A real person has to do something—click, install, enable—otherwise it doesn’t land. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:L) Some sensitive info could get out, but not a total data dump. Integrity (I:N) Data isn’t meaningfully altered or forged. Availability (A:N) Service keeps running; no real outage angle.	1.6	1.4	[email protected]
2.6	2.0	LOW	`AV:N/AC:H/Au:N/C:P/I:N/A:N` Click to expand Access vector (AV:N) Can be exploited remotely over network reachability. Access complexity (AC:H) Exploitation requires uncommon or highly specific conditions. Authentication (AU:N) No authentication is required. Confidentiality impact (C:P) Partial confidentiality impact. Integrity impact (I:N) No integrity impact. Availability impact (A:N) No availability impact.	4.9	2.9	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

3.1

3.0

LOW

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N Click to expand

Attack vector (AV:N): Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:H): Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work.
Privileges required (PR:N): No account or special rights needed—anonymous or random user is enough.
User interaction (UI:R): A real person has to do something—click, install, enable—otherwise it doesn’t land.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:L): Some sensitive info could get out, but not a total data dump.
Integrity (I:N): Data isn’t meaningfully altered or forged.
Availability (A:N): Service keeps running; no real outage angle.

1.6

1.4

[email protected]

2.6

2.0

LOW

AV:N/AC:H/Au:N/C:P/I:N/A:N Click to expand

Access vector (AV:N): Can be exploited remotely over network reachability.
Access complexity (AC:H): Exploitation requires uncommon or highly specific conditions.
Authentication (AU:N): No authentication is required.
Confidentiality impact (C:P): Partial confidentiality impact.
Integrity impact (I:N): No integrity impact.
Availability impact (A:N): No availability impact.

4.9

2.9

[email protected]

Affected software / configurations for CVE-2018-8482

Vendor	Product	Version	Raw CPE
microsoft	windows_10	—	cpe:2.3:o:microsoft:windows_10:-:::::::*
microsoft	windows_10	1607	cpe:2.3:o:microsoft:windows_10:1607:::::::*
microsoft	windows_10	1703	cpe:2.3:o:microsoft:windows_10:1703:::::::*
microsoft	windows_10	1709	cpe:2.3:o:microsoft:windows_10:1709:::::::*
microsoft	windows_10	1803	cpe:2.3:o:microsoft:windows_10:1803:::::::*
microsoft	windows_10	1809	cpe:2.3:o:microsoft:windows_10:1809:::::::*
microsoft	windows_7	—	cpe:2.3:o:microsoft:windows_7:-:sp1::::::
microsoft	windows_8.1	—	cpe:2.3:o:microsoft:windows_8.1::::::::
microsoft	windows_rt_8.1	—	cpe:2.3:o:microsoft:windows_rt_8.1:-:::::::*
microsoft	windows_server_2008	—	cpe:2.3:o:microsoft:windows_server_2008:-:sp2::::::
microsoft	windows_server_2008	r2	cpe:2.3:o:microsoft:windows_server_2008:r2:sp1::::::
microsoft	windows_server_2012	—	cpe:2.3:o:microsoft:windows_server_2012:-:::::::*
microsoft	windows_server_2012	r2	cpe:2.3:o:microsoft:windows_server_2012:r2:::::::*
microsoft	windows_server_2016	—	cpe:2.3:o:microsoft:windows_server_2016:-:::::::*
microsoft	windows_server_2016	1709	cpe:2.3:o:microsoft:windows_server_2016:1709:::::::*
microsoft	windows_server_2016	1803	cpe:2.3:o:microsoft:windows_server_2016:1803:::::::*
microsoft	windows_server_2019	—	cpe:2.3:o:microsoft:windows_server_2019:-:::::::*

References for CVE-2018-8482

URL	Tags
http://www.securityfocus.com/bid/105469	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1041829	Third Party Advisory VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8482	Patch Vendor Advisory

URL

CVE-2018-8482

Exploit prediction scoring system (EPSS) score for CVE-2018-8482

Common vulnerability scoring system (CVSS) metrics for CVE-2018-8482

Weakness enumeration for CVE-2018-8482

Affected software / configurations for CVE-2018-8482

References for CVE-2018-8482