CVE-2018-0798

Published: Jan 10, 2018Modified: Oct 28, 2025CISA KEV

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Office Memory Corruption Vulnerability".

Affected (11)

Products: Microsoft: Office, Office Compatibility Pack, Word

3 products

Office Compatibility Pack

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Microsoft Office	Version 2007 sp3
Microsoft Office	Version 2010 sp2
Microsoft Office	Version 2013 sp1
Microsoft Office	Version 2016
Microsoft Office	Version 2016
Microsoft Office Compatibility Pack	All versions
Microsoft Word	Version 2007 sp3
Microsoft Word	Version 2010 sp2
Microsoft Word	Version 2013 sp1
Microsoft Word	Version 2013 sp1
Microsoft Word	Version 2016

Related CWEs

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (9)

http://www.securityfocus.com/bid/102370

Source: secure@microsoft.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1040153

Source: secure@microsoft.com

Broken LinkThird Party AdvisoryVDB Entry

https://0patch.blogspot.com/2018/01/bringing-abandoned-equation-editor-back.html

Source: secure@microsoft.com

Third Party Advisory

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0798

Source: secure@microsoft.com

PatchVendor Advisory

http://www.securityfocus.com/bid/102370

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1040153

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkThird Party AdvisoryVDB Entry

https://0patch.blogspot.com/2018/01/bringing-abandoned-equation-editor-back.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0798

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0798

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

US Government Resource

Timeline

No history available yet.