CVE-2018-0798
Microsoft Office Memory Corruption Vulnerability
Description
CVE-2018-0798 is a high-severity memory corruption vulnerability in the Equation Editor component of Microsoft Office. The flaw exists due to the way objects are handled in memory, enabling a remote attacker to execute arbitrary code in the context of the current user. CISA has confirmed active exploitation by adding this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog. With an exceptionally high EPSS score of 94.03% (99.9th percentile), CVE-2018-0798 represents one of the most likely exploited vulnerabilities in the wild. This vulnerability is known to be chained with CVE-2018-0802 for enhanced attack capabilities.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | office | 2007; 2010; 2013; 2016 |
| microsoft | office compatibility pack | - |
| microsoft | word | 2007; 2010; 2013; 2016 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://www.securityfocus.com/bid/102370(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1040153(Broken Link, Third Party Advisory, VDB Entry)
- https://0patch.blogspot.com/2018/01/bringing-abandoned-equation-editor-back.html(Third Party Advisory)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0798(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0798(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
Out-of-bounds Write is a vulnerability that occurs when software writes data past the end or before the beginning of the intended buffer. In the context of CVE-2018-0798, the Microsoft Office Equation Editor improperly handles objects in memory, leading to an out-of-bounds write condition that allows attackers to corrupt memory and execute arbitrary code.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2018-0798 carries a CVSS 3.1 score of 8.8 (HIGH), indicating a severe threat to organizations using affected Microsoft Office versions. The vulnerability is remotely exploitable over the network with low attack complexity, requiring no authentication from the attacker. User interaction is required, typically in the form of opening a malicious document, but social engineering techniques make this a reliable attack vector. Successful exploitation delivers full impact across confidentiality, integrity, and availability, granting the attacker code execution rights equivalent to those of the current user. Given the EPSS score of 94.03% placing it in the 99.9th percentile, this vulnerability has near-certain exploitation activity and should be treated with maximum urgency.
Exploit Maturity
CVE-2018-0798 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog, with a remediation deadline of 2022-05-03. The EPSS score of 94.03% (99.9th percentile) indicates near-certain active exploitation, placing it among the most exploited vulnerabilities tracked. The KEV description explicitly notes that this vulnerability is known to be chained with CVE-2018-0802, another Equation Editor memory corruption flaw, creating a more potent attack chain that threat actors leverage for reliable remote code execution. Third-party advisories and VDB entries from SecurityFocus and analysis from 0patch provide additional context on the exploit landscape.
Remediation
- Apply Microsoft security updates immediately as directed by the CISA KEV catalog. Install patches from the Microsoft Security Response Center for all affected products.
- Verify that all instances of affected products have been updated, including Microsoft Office 2007, 2010, 2013, and 2016, Microsoft Office Compatibility Pack, and Microsoft Word 2007, 2010, 2013, and 2016.
- As an interim mitigation, disable the Equation Editor component (EQNEDT32.EXE) if patching is not immediately possible. This can be done by removing the registry key at HKLM\SOFTWARE\Microsoft\Office\Common\COM Compatibility{0002CE02-0000-0000-C000-000000000046} or by denying execute permissions on eqnedt32.exe.
- Implement email and document filtering to block malicious Office documents at the network perimeter, particularly those containing embedded Equation Editor objects.
- Monitor for indicators of compromise including unexpected child processes spawned by Office applications, suspicious network connections from Office processes, and anomalous Equation Editor component activity.
Technical Details
CVE-2018-0798 affects the Equation Editor component (EQNEDT32.EXE) in Microsoft Office, a legacy binary that was compiled without modern exploit mitigations such as ASLR and DEP. The vulnerability stems from an out-of-bounds write condition triggered when the Equation Editor improperly handles crafted objects in memory, enabling an attacker to overwrite adjacent memory and redirect execution flow to attacker-controlled code. The CVSS vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects that the vulnerability is network-exploitable with low complexity, requires no privileges but does require user interaction (opening a malicious document), and results in complete compromise of confidentiality, integrity, and availability. The chaining relationship with CVE-2018-0802 suggests that attackers use both vulnerabilities together to bypass different defensive measures and achieve more reliable exploitation.
Frequently Asked Questions
Is CVE-2018-0798 being actively exploited?
Yes. CVE-2018-0798 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 94.03% (99.9th percentile) further indicates near-certain exploitation activity, making this one of the most actively targeted vulnerabilities.
What products are affected by CVE-2018-0798?
CVE-2018-0798 affects the Equation Editor component in Microsoft Office 2007, 2010, 2013, and 2016, as well as Microsoft Office Compatibility Pack and Microsoft Word 2007, 2010, 2013, and 2016.
How do I fix CVE-2018-0798?
Apply the January 2018 security updates from Microsoft for all affected Office products. As an additional mitigation, disable or remove the legacy Equation Editor component (EQNEDT32.EXE) to eliminate the attack surface entirely.
How severe is CVE-2018-0798?
CVE-2018-0798 has a CVSS 3.1 score of 8.8 (HIGH). With an EPSS score in the 99.9th percentile and confirmed active exploitation, this is an extremely severe vulnerability that demands immediate remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.