---
title: "Windows COM CVE-2018-0824: APT41 Reuses a 2018 Exploit"
url: https://erroneo.us/security/briefs/windows-com-cve-2018-0824-apt41-unmarshalpwn/
description: "A 2018 Windows COM bug with a public exploit that gives SYSTEM. APT41 tried it in a 2023 intrusion; KEV since Aug 2024. Find hosts unpatched since 2018."
type: security-brief
section: "Security Digest"
date_published: 2018-05-08
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2018-0824"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Windows COM CVE-2018-0824: APT41 Reuses a 2018 Exploit

**Verdict: Check exposure.** Fixed in May 2018 and absent from current Windows releases; the only real exposure is legacy hosts that have missed updates since 2018, which should be found and replaced or isolated.

- **Who must act:** Anyone still running Windows 7, 8.1, Windows 10 1803 or earlier, or Windows Server 2008 through 2016 hosts that have not taken updates since May 2018, especially research and government networks.
- **Who can relax:** Fleets patched at any point since May 2018; Windows 10 1809 and later, Windows 11 and Windows Server 2019 and later are not in Microsoft's affected list.
- **Affected:** Windows 7 SP1, Windows 8.1 and Windows RT 8.1; Windows 10 1507, 1607, 1703, 1709 and 1803; Windows Server 2008 SP2, 2008 R2 SP1, 2012, 2012 R2 and 2016; Windows Server version 1709 and 1803 (Server Core)
- **Fixed:** May 8, 2018 security updates; KB4103723 (Windows 10 1607 / Server 2016), KB4103731 (1703), KB4103727 (1709), KB4103721 (1803), KB4103716 (1507); KB4103718 monthly rollup or KB4103712 security-only (Windows 7 / Server 2008 R2); KB4103725 or KB4103715 (Windows 8.1 / Server 2012 R2), KB4103730 or KB4103726 (Server 2012), KB4101477 (Server 2008)
- **CVEs:** CVE-2018-0824
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. List hosts still on Windows 7, 8.1, Windows 10 1803 or earlier, or Server 2008/2012-era builds.
2. On each, confirm the May 2018 update for that version or later monthly updates are installed.
3. Replace or isolate unsupported Windows hosts, and keep local logon on them limited to the people who need it.
4. Upgrade Windows 10 1803 and earlier to a supported release.

### How to check if you are affected

- Search EDR and antivirus history for Unmarshal.exe and the Talos ClamAV signatures Win.Loader.UnmarshalPwn-10019486-0 and Win.Packed.UnmarshalPwn-10019484-0.
- Look for the old Office IME binary imecmnt.exe running outside an Office install next to imjp14k.dll or imjp14k.dll.dat, which Talos says loaded ShadowPad.
- Match proxy and DNS logs against the Talos IOC list, which includes w2.chatgptsfit[.]com.
- Treat Mimikatz, WebBrowserPassView or unexpected 7-Zip archiving on a server as signs of credential theft and staging.

## What happened

On May 8, 2018, Microsoft fixed [CVE-2018-0824](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2018-0824), a flaw in which "Microsoft COM for Windows" fails to properly handle serialized objects. Microsoft filed it as remote code execution: a victim would have to open a crafted file or script sent by email or hosted on a website. It scored the bug CVSS 3.0 7.5 and rated exploitation "less likely". [NVD](https://nvd.nist.gov/vuln/detail/CVE-2018-0824) scores it 8.8.

The bug soon got a second use as a local privilege escalation. On June 15, 2018, Code White diffed the patch and published ["Marshalling to SYSTEM"](https://codewhitesec.blogspot.com/2018/06/cve-2018-0624.html). It traced the flaw to `CMarshalInterceptor::UnmarshalInterface()` in `comsvcs.dll` and showed how to abuse the SearchIndexer service, which runs as SYSTEM, to start a process as SYSTEM. The proof of concept, [UnmarshalPwn](https://github.com/codewhitesec/UnmarshalPwn), has been on GitHub since then.

That public code surfaced six years later. On August 1, 2024, [Cisco Talos](https://blog.talosintelligence.com/chinese-hacking-group-apt41-compromised-taiwanese-government-affiliated-research-institute-with-shadowpad-and-cobaltstrike-2/) reported an intrusion at a Taiwanese government-affiliated research institute, which it attributes to China's APT41 with medium confidence. The activity started as early as July 2023, and Talos found it in August 2023. The attackers compromised three hosts, deployed ShadowPad and Cobalt Strike, harvested credentials with Mimikatz and took some documents. Talos says the actor "attempts to exploit CVE-2018-0824" with a custom loader, `Unmarshal.exe`, which decrypts UnmarshalPwn in four stages and injects it into memory. Talos does not say whether the escalation worked or whether the hosts were missing the patch. CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0824) on August 5, 2024, with an August 26 deadline.

## Who is affected

Microsoft's [May 2018 update data](https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2018-May) lists Windows 7 SP1, Windows 8.1 and RT 8.1, Windows 10 1507 through 1803, and Windows Server 2008 SP2, 2008 R2 SP1, 2012, 2012 R2 and 2016, plus Server 1709 and 1803. Windows 10 1809 and later, Windows 11 and Server 2019 and later are not on the list. Fixes include KB4103723 for Windows 10 1607 and Server 2016, and KB4103718 (monthly rollup) or KB4103712 (security-only) for Windows 7 and Server 2008 R2.

## Do you really need to act?

Most organizations can treat this as a hygiene check. The fix is more than eight years old, and most affected versions are out of support. Windows 7 and Server 2008 extended updates ended on January 10, 2023, and Server 2012 and 2012 R2 support on October 10, 2023, per [Microsoft's lifecycle list](https://learn.microsoft.com/en-us/lifecycle/end-of-support/end-of-support-2023). The exposure is machines that have missed updates since 2018: lab and instrument PCs, factory hosts, forgotten file servers. On such a machine this is one of many public escalation exploits, so patching this CVE alone does not make it safe. The Talos case shows that a capable state group will still use an old public exploit when it fits.

## What to do now

1. Find legacy hosts: `Get-CimInstance Win32_OperatingSystem | Select-Object Caption, Version, BuildNumber`, or pull the same from your asset inventory.
2. On each, check update history with `Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5`, and look for the May 2018 package for that version or later monthly updates.
3. Replace or isolate unsupported Windows hosts, and limit who can log on to them locally.
4. Upgrade Windows 10 1803 and earlier to a supported release.

## How to tell if you were hit

- Search EDR and antivirus history for `Unmarshal.exe` and the Talos ClamAV signatures `Win.Loader.UnmarshalPwn-10019486-0` and `Win.Packed.UnmarshalPwn-10019484-0`.
- Look for `imecmnt.exe`, a 13-year-old Office IME binary, running outside an Office install next to `imjp14k.dll` or `imjp14k.dll.dat`. Talos says APT41 used it to load ShadowPad.
- Match proxy and DNS logs against the [Talos IOC list](https://raw.githubusercontent.com/Cisco-Talos/IOCs/main/2024/08/chinese-hacking-group-apt41-compromised-taiwanese-government-affiliated-research-institute.txt), which includes `w2.chatgptsfit[.]com`.
- Treat Mimikatz, WebBrowserPassView or unexpected 7-Zip archiving on a server as signs of credential theft and data staging.

## Timeline

- May 8, 2018 — Microsoft fixes CVE-2018-0824.
- Jun 15, 2018 — Code White publishes its analysis and the UnmarshalPwn proof of concept.
- Jan 10, 2023 — Extended updates for Windows 7 and Server 2008 end; Windows 8.1 reaches end of support.
- July 2023 — The APT41-linked intrusion in Taiwan begins, per Talos.
- Oct 10, 2023 — Windows Server 2012 and 2012 R2 reach end of support.
- Aug 1, 2024 — Cisco Talos publishes its report.
- Aug 5, 2024 — CISA adds the CVE to KEV; the federal deadline is Aug 26.

## Sources

1. [Microsoft — Security Update Guide: CVE-2018-0824 Microsoft COM for Windows Remote Code Execution Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2018-0824)
2. [Microsoft — May 2018 Security Updates (CVRF)](https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2018-May)
3. [CVE record — CVE-2018-0824](https://www.cve.org/CVERecord?id=CVE-2018-0824)
4. [NVD — CVE-2018-0824](https://nvd.nist.gov/vuln/detail/CVE-2018-0824)
5. [CISA — Known Exploited Vulnerabilities: CVE-2018-0824](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0824)
6. [Cisco Talos — APT41 likely compromised Taiwanese government-affiliated research institute with ShadowPad and Cobalt Strike](https://blog.talosintelligence.com/chinese-hacking-group-apt41-compromised-taiwanese-government-affiliated-research-institute-with-shadowpad-and-cobaltstrike-2/)
7. [Cisco Talos — IOCs for the APT41 Taiwanese research institute intrusion](https://raw.githubusercontent.com/Cisco-Talos/IOCs/main/2024/08/chinese-hacking-group-apt41-compromised-taiwanese-government-affiliated-research-institute.txt)
8. [Code White — Marshalling to SYSTEM: An analysis of CVE-2018-0824](https://codewhitesec.blogspot.com/2018/06/cve-2018-0624.html)
9. [Code White — UnmarshalPwn: POC for CVE-2018-0824 (GitHub)](https://github.com/codewhitesec/UnmarshalPwn)
10. [Microsoft Learn — Ending Support in 2023](https://learn.microsoft.com/en-us/lifecycle/end-of-support/end-of-support-2023)

---
Source page: https://erroneo.us/security/briefs/windows-com-cve-2018-0824-apt41-unmarshalpwn/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt