Is CVE-2018-3639 being actively exploited?

CVE-2018-3639 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2018-3639?

CVE-2018-3639 has a CVSS 3.1 base score of 5.5 (MEDIUM).

CVE-2018-3639

MEDIUM · CVSS 5.5EPSS 60.6%EU EUVD

Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4.

Key facts

CVSS score: 5.5 (v3.1)
Severity: MEDIUM
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness (CWE): CWE-203
EPSS score: 60.6% (99th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2018-15493)
Published: May 22, 2018
NVD last modified: June 17, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2018-15493 in the EU Vulnerability Database. Last updated in EUVD on May 29, 2026.

View on the EU Vulnerability Database

Affected products

arm / cortex-a
arm / cortex-a
arm / cortex-a
canonical / ubuntu linux
canonical / ubuntu linux
canonical / ubuntu linux
canonical / ubuntu linux
canonical / ubuntu linux
debian / debian linux
debian / debian linux
intel / atom c
intel / atom c
intel / atom c
intel / atom c
intel / atom c
intel / atom c
intel / atom c
intel / atom c
intel / atom c
intel / atom c
intel / atom c
intel / atom c
intel / atom c
intel / atom c
intel / atom c
intel / atom c
intel / atom e
intel / atom e
intel / atom e
intel / atom e
intel / atom e
intel / atom e
intel / atom x5-e3930
intel / atom x5-e3940
intel / atom x7-e3950
intel / atom z
intel / atom z
intel / atom z
intel / atom z
intel / atom z
intel / atom z
intel / atom z
intel / atom z
intel / atom z
intel / atom z
intel / atom z
intel / atom z
intel / atom z
intel / atom z
intel / atom z

and 615 more…

Certified products that may be affected

4 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

Red Hat Virtualization v4.3 - Red Hat, Inc. - Common Criteria OCSI/CERT/ATS/08/2020/RC - active
Red Hat Enterprise Linux 7.6 - Red Hat, Inc. - Common Criteria CCEVS-VR-VID-11039-2020 - archived
Windows 7 BitLocker™ Drive Encryption - Microsoft Corporation - FIPS 140 1332 - historical
Microsoft Windows 7 Kernel Mode Cryptographic Primitives Library (cng.sys) - Microsoft Corporation - FIPS 140 1328 - historical

References

http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00058.html(Broken Link)
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00059.html(Broken Link)
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00007.html(Broken Link)
http://support.lenovo.com/us/en/solutions/LEN-22133(Third Party Advisory)
http://www.fujitsu.com/global/support/products/software/security/products-f/cve-2018-3639e.html(Third Party Advisory)
http://www.openwall.com/lists/oss-security/2020/06/10/1(Mailing List, Third Party Advisory)
http://www.openwall.com/lists/oss-security/2020/06/10/2(Mailing List, Third Party Advisory)
http://www.openwall.com/lists/oss-security/2020/06/10/5(Mailing List, Third Party Advisory)
http://www.securityfocus.com/bid/104232(Third Party Advisory, VDB Entry)
http://www.securitytracker.com/id/1040949(Third Party Advisory, VDB Entry)
http://www.securitytracker.com/id/1042004(Third Party Advisory, VDB Entry)
http://xenbits.xen.org/xsa/advisory-263.html(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:1629(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:1630(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:1632(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:1633(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:1635(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:1636(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:1637(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:1638(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:1639(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:1640(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:1641(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:1642(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:1643(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:1644(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:1645(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:1646(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:1647(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:1648(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:1649(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:1650(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:1651(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:1652(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:1653(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:1654(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:1655(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:1656(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:1657(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:1658(Third Party Advisory)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain