CVE-2018-0802highunder attackransomwareCWE-787

CVE-2018-0802: high-severity vulnerability in Microsoft Corporation Equation Editor

Published · Updated

Follow this CVE+ Monitor Microsoft Office+ Monitor Equation Editor

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

98Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA, has a public proof of concept and 6 threat group(s) use it.

ssvc Actcvss 7.8epss 93%
from disclosure to weapon1 day
Published on NVDJan 10
1st PoC+1d
CISA KEV+1393d
Who exploits it — 6

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

APT / StateBITTER🇨🇳 MITRE ATT&CK
APT / StateBRONZE BUTLER🇨🇳 MITRE ATT&CK
APT / StateConfucius MITRE ATT&CK
APT / StateInception🇷🇺 MITRE ATT&CK
APT / StateTonto Team🇨🇳 MITRE ATT&CK
APT / StateTropic Trooper MITRE ATT&CK
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

Microsoft Office's Equation Editor has a flaw that allows hackers to run malicious code on your computer when you open a specially crafted document. This happens because the software doesn't properly manage memory, letting attackers take control of your system.

Technical detail

A memory corruption vulnerability in Equation Editor (EQNEDT32.EXE) across Office 2007-2016 allows arbitrary code execution via malformed OLE objects embedded in Office documents. The attack requires user interaction (opening a malicious document) and results in execution with the privileges of the affected user.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE is unique from CVE-2018-0797 and CVE-2018-0812.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Microsoft Corporation · Equation Editor
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Microsoft Corporation Equation Editor

In the same product, most dangerous first.

CVE-2018-0798HIGHCVE-2018-0798EPSS 95.1%KEVCVE-2018-0812—CVE-2018-0812EPSS 24.7%CVE-2018-0806—CVE-2018-0806EPSS 24.5%CVE-2018-0805—CVE-2018-0805EPSS 24.4%CVE-2018-0801—CVE-2018-0801EPSS 24.4%CVE-2018-0807—CVE-2018-0807EPSS 24.4%