Vulnerability record · CVE-2018-0802 · published 10 January 2018
CVE-2018-0802: Microsoft Office Equation Editor Memory Corruption RCE
Microsoft · Office
Equation Editor in Microsoft Office 2007, 2010, 2013, and 2016 mishandles objects in memory, causing an out-of-bounds write (CWE-787) that can lead to remote code execution. Because Equation Editor content is embedded in ordinary Office documents, a crafted file can execute code in the context of the opening user. It is a distinct flaw from CVE-2018-0797 and CVE-2018-0812.
Description
Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE is unique from CVE-2018-0797 and CVE-2018-0812.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
critical priorityIt is in CISA KEV with known ransomware use, has a very high EPSS score, public exploit code, and yields code execution on unpatched Office endpoints.
What it is
Equation Editor in Microsoft Office 2007, 2010, 2013, and 2016 mishandles objects in memory, causing an out-of-bounds write (CWE-787) that can lead to remote code execution. Because Equation Editor content is embedded in ordinary Office documents, a crafted file can execute code in the context of the opening user. It is a distinct flaw from CVE-2018-0797 and CVE-2018-0812.
Impact
An attacker who gets a victim to open a malicious document can execute arbitrary code with the privileges of that user, giving full control of confidentiality, integrity, and availability on the host. CISA KEV records known ransomware campaign use, so impact can extend to enterprise-wide encryption and disruption.
Attack surface
Reached locally when a user opens a specially crafted Office file containing a malicious Equation Editor object; the CVSS vector is AV:L/PR:N/UI:R, so no authentication is required but user interaction (opening the document) is. Delivery is typically via email attachment, web download, or shared file.
Exploitation
CISA added it to KEV on 2021-11-03 with known ransomware campaign use, and EPSS is 0.93289 (99.831st percentile), indicating very high likelihood of exploitation. Multiple references are tagged Exploit, including public proof-of-concept code.
What to do
- Apply the Microsoft security update for CVE-2018-0802 to all affected Office versions and the Office Compatibility Pack.
- Remove or disable Equation Editor (EQNEDT32.EXE) where it is not required, per Microsoft guidance.
- Block or strip Equation Editor OLE objects and legacy .doc/.rtf content at email and web gateways.
- Enforce Protected View and disable macros for documents from untrusted sources.
- Track KEV remediation deadlines and confirm patched status across endpoints.
Detection
- Monitor for EQNEDT32.EXE spawning child processes such as cmd.exe, powershell.exe, or wscript.exe.
- Alert on Office applications writing executables or scripts to temp or startup directories.
- Scan email and file shares for documents containing embedded Equation Editor objects, especially from external senders.
- Hunt for known CVE-2018-0802 exploit artifacts and PoC-derived payload patterns in document metadata and process telemetry.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2018-0802 to the Known Exploited Vulnerabilities catalog on 3 November 2021 as "Microsoft Office Memory Corruption Vulnerability". CISA reports known use in ransomware campaigns. Required action: Apply updates per vendor instructions. Federal deadline 3 May 2022.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2018-0802 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2018-0802), CISA KEV, FIRST EPSS (scores of 2026-09-25). This page is refreshed as NVD updates the record.
