Vulnerability record · CVE-2018-0798 · published 10 January 2018
CVE-2018-0798: Microsoft Office Equation Editor memory corruption RCE
Microsoft · Office
Equation Editor in Microsoft Office 2007 through 2016 mishandles objects in memory, producing an out-of-bounds write (CWE-787) that can be turned into remote code execution. Because the component is a legacy, largely abandoned binary, it has remained an attractive target long after the affected Office versions shipped.
Description
Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Office Memory Corruption Vulnerability".
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
critical priorityIt is in CISA KEV with a near-maximum EPSS score and allows unauthenticated remote code execution via a user-opened document.
What it is
Equation Editor in Microsoft Office 2007 through 2016 mishandles objects in memory, producing an out-of-bounds write (CWE-787) that can be turned into remote code execution. Because the component is a legacy, largely abandoned binary, it has remained an attractive target long after the affected Office versions shipped.
Impact
An attacker who gets a crafted document opened can execute code in the context of the victim user, giving full control of confidentiality, integrity and availability on that host.
Attack surface
Reached over the network via a malicious Office file or embedded object that the user must open or interact with; no credentials are required (CVSS vector AV:N/AC:L/PR:N/UI:R).
Exploitation
Listed in CISA KEV since 2021-11-03 with a required action to patch, and EPSS 30-day probability is 0.95121 (99.86th percentile), indicating observed exploitation and very high likelihood. No ransomware campaign use is recorded.
What to do
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2018-0798 across all affected Office versions.
- Remove or disable the Equation Editor component (EQNEDT32.EXE) where it is not required, or apply the third-party 0patch mitigation for abandoned versions.
- Block or strip legacy Equation Editor OLE objects at email and web gateways, and enforce Mark-of-the-Web/Protected View for untrusted documents.
- Retire Office 2007/2010/2013/2016 installations that no longer receive security fixes.
- Restrict users from opening documents from untrusted sources and disable macros and embedded object activation by policy.
Detection
- Hunt for Office processes spawning EQNEDT32.EXE, especially when the parent is WINWORD.EXE or EXCEL.EXE.
- Monitor for child processes spawned by EQNEDT32.EXE or Office applications, which is abnormal and consistent with exploitation.
- Alert on Office documents containing Equation Editor OLE objects arriving from external senders or downloads.
- Correlate endpoint telemetry for crashes or memory-corruption indicators in EQNEDT32.EXE with subsequent process creation.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2018-0798 to the Known Exploited Vulnerabilities catalog on 3 November 2021 as "Microsoft Office Memory Corruption Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 3 May 2022.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://www.securityfocus.com/bid/102370 | Broken LinkThird Party AdvisoryVDB Entry |
| http://www.securitytracker.com/id/1040153 | Broken LinkThird Party AdvisoryVDB Entry |
| https://0patch.blogspot.com/2018/01/bringing-abandoned-equation-editor-back.html | Third Party Advisory |
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0798 | PatchVendor Advisory |
| http://www.securityfocus.com/bid/102370 | Broken LinkThird Party AdvisoryVDB Entry |
| http://www.securitytracker.com/id/1040153 | Broken LinkThird Party AdvisoryVDB Entry |
| https://0patch.blogspot.com/2018/01/bringing-abandoned-equation-editor-back.html | Third Party Advisory |
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0798 | PatchVendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0798 | US Government Resource |
Track CVE-2018-0798 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2018-0798), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.
