CVE-2018-0798highunder attackCWE-787

CVE-2018-0798: high-severity vulnerability in Microsoft Corporation Equation Editor

Published · Updated

Follow this CVE+ Monitor Microsoft Office+ Monitor Equation Editor

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

93Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA, has a public proof of concept and 5 threat group(s) use it.

ssvc Actcvss 8.8epss 95%
from disclosure to weapon1682 days
Published on NVDJan 10
1st PoC+1682d
CISA KEV+1393d
Who exploits it — 5

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

APT / StateBITTER🇨🇳 MITRE ATT&CK
APT / StateBRONZE BUTLER🇨🇳 MITRE ATT&CK
APT / StateHigaisa🇰🇵 MITRE ATT&CK
APT / StateThreat Group-3390🇨🇳 MITRE ATT&CK
APT / StateTonto Team🇨🇳 MITRE ATT&CK
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

A flaw in Microsoft Office's Equation Editor allows attackers to run malicious code on your computer when you open a specially crafted Office document. This happens because the software doesn't properly manage memory when handling certain objects.

Technical detail

Memory corruption vulnerability in Equation Editor component across Office 2007-2016 exploited via crafted OLE objects in Office documents. Attack vector is network-based through document opening; requires user interaction to trigger object instantiation. Successful exploitation results in arbitrary code execution with user privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Office Memory Corruption Vulnerability".
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Microsoft Corporation · Equation Editor
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Microsoft Corporation Equation Editor

In the same product, most dangerous first.

CVE-2018-0802HIGHCVE-2018-0802EPSS 93.3%KEVCVE-2018-0812—CVE-2018-0812EPSS 24.7%CVE-2018-0806—CVE-2018-0806EPSS 24.5%CVE-2018-0805—CVE-2018-0805EPSS 24.4%CVE-2018-0801—CVE-2018-0801EPSS 24.4%CVE-2018-0807—CVE-2018-0807EPSS 24.4%