CVE-2018-0802
Microsoft Office Memory Corruption Vulnerability
Description
CVE-2018-0802 is a high-severity memory corruption vulnerability in the Equation Editor component of Microsoft Office. The flaw results from improper handling of objects in memory within the Equation Editor, allowing a remote attacker to execute arbitrary code in the context of the current user. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 93.89% (99.9th percentile), CVE-2018-0802 is among the most likely exploited vulnerabilities. This vulnerability is commonly chained with CVE-2018-0798 to enhance exploitation reliability.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | office | 2007; 2010; 2013; 2016 |
| microsoft | office compatibility pack | - |
| microsoft | word | 2007; 2010; 2013; 2016 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://www.securityfocus.com/bid/102347(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1040153(Broken Link, Third Party Advisory, VDB Entry)
- https://0patch.blogspot.com/2018/01/the-bug-that-killed-equation-editor-how.html(Exploit, Third Party Advisory)
- https://github.com/rxwx/CVE-2018-0802(Exploit, Third Party Advisory)
- https://github.com/zldww2011/CVE-2018-0802_POC(Third Party Advisory)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0802(Patch, Vendor Advisory)
- https://research.checkpoint.com/another-office-equation-rce-vulnerability/(Exploit)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0802(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
Out-of-bounds Write is a vulnerability where software writes data past the boundaries of the intended buffer. In CVE-2018-0802, the Microsoft Office Equation Editor fails to properly validate memory operations when processing crafted objects, leading to an out-of-bounds write that allows an attacker to corrupt memory structures and achieve arbitrary code execution.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2018-0802 carries a CVSS 3.1 score of 7.8 (HIGH), reflecting a serious threat to organizations running affected Microsoft Office installations. The vulnerability requires local attack vector with low complexity, meaning exploitation typically occurs when a user opens a maliciously crafted document. No privileges are required from the attacker, though user interaction in the form of opening the document is necessary. Successful exploitation results in complete compromise of confidentiality, integrity, and availability, granting the attacker full code execution rights under the current user context. The EPSS score of 93.89% in the 99.9th percentile confirms near-certain exploitation activity, and the chaining potential with CVE-2018-0798 makes this vulnerability especially dangerous in targeted attack campaigns against Office users.
Exploit Maturity
CVE-2018-0802 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog, with a remediation deadline of 2022-05-03. Public exploit code is available for CVE-2018-0802 via multiple sources, including GitHub (rxwx), 0patch analysis, and Check Point Research. The EPSS score of 93.89% (99.9th percentile) indicates near-certain active exploitation. This vulnerability is frequently chained with CVE-2018-0798, another Equation Editor memory corruption flaw, to create a highly reliable exploitation chain used in targeted attacks.
Remediation
- Apply Microsoft security updates immediately as mandated by the CISA KEV catalog. Install patches from the Microsoft Security Response Center for all affected Office installations.
- Verify that all instances of affected products have been updated, including Microsoft Office 2007, 2010, 2013, and 2016, Microsoft Office Compatibility Pack, and Microsoft Word 2007, 2010, 2013, and 2016.
- Disable or remove the Equation Editor component (EQNEDT32.EXE) as an interim mitigation by modifying the COM compatibility registry key or denying execute permissions on the binary. Microsoft permanently removed the Equation Editor in later updates.
- Implement document sandboxing and email attachment scanning to detect and block malicious Office documents containing Equation Editor exploits before they reach end users.
- Review endpoint logs for indicators of compromise including anomalous child processes spawned by EQNEDT32.EXE, suspicious Office document behavior, and unexpected network connections from Office applications.
Technical Details
CVE-2018-0802 targets the Equation Editor component (EQNEDT32.EXE) in Microsoft Office, a legacy out-of-process COM server that was originally written in 2000 and compiled without Address Space Layout Randomization (ASLR) or Data Execution Prevention (DEP). The vulnerability is an out-of-bounds write that occurs when the Equation Editor processes a specially crafted document containing malformed objects, allowing an attacker to write arbitrary data beyond the allocated buffer boundaries. The CVSS vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates local exploitation (typically via document opening) with low complexity, no privilege requirements, but mandatory user interaction. This vulnerability is distinct from CVE-2018-0797 and CVE-2018-0812 but shares the same root cause in the Equation Editor memory handling logic, and when chained with CVE-2018-0798, provides attackers with multiple exploitation paths for reliable code execution.
Frequently Asked Questions
Is CVE-2018-0802 being actively exploited?
Yes. CVE-2018-0802 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. Multiple public exploit repositories and proof-of-concept code are available, and the EPSS score of 93.89% (99.9th percentile) confirms near-certain exploitation activity.
What products are affected by CVE-2018-0802?
CVE-2018-0802 affects the Equation Editor component in Microsoft Office 2007, 2010, 2013, and 2016, as well as Microsoft Office Compatibility Pack and Microsoft Word 2007, 2010, 2013, and 2016.
How do I fix CVE-2018-0802?
Apply the January 2018 security updates from Microsoft for all affected Office products. Additionally, disable or remove the legacy Equation Editor component (EQNEDT32.EXE) to fully eliminate the attack surface. Microsoft has permanently removed the Equation Editor in later updates.
How severe is CVE-2018-0802?
CVE-2018-0802 has a CVSS 3.1 score of 7.8 (HIGH). With an EPSS score in the 99.9th percentile, publicly available exploit code, and confirmed active exploitation, this is an extremely severe vulnerability requiring immediate patching.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.