CVE-2018-0802
HIGHCVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
5Description
Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE is unique from CVE-2018-0797 and CVE-2018-0812.
Analysis
Microsoft Office Equation Editor allows remote code execution through crafted documents, the third vulnerability in the Equation Editor trifecta (with CVE-2017-11882 and CVE-2018-0798) that collectively dominated the exploit landscape in 2018.
Technical Context
The CWE-787 flaw in EQNEDT32.EXE provides yet another exploitation path in the same unprotected binary. Like its siblings, the exploit is deterministic due to the absence of modern exploit mitigations in the 2000-era compiled binary.
Affected Products
['Microsoft Office 2007 SP3', 'Microsoft Office 2010 SP2', 'Microsoft Office 2013 SP1', 'Microsoft Office 2016']
Remediation
Apply all Equation Editor patches and then remove EQNEDT32.EXE entirely. Microsoft disabled the Equation Editor in later Office updates. Block documents containing equation objects at email gateways.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today