CVE-2018-0802

Published: Jan 10, 2018Modified: Oct 28, 2025CISA KEV

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE is unique from CVE-2018-0797 and CVE-2018-0812.

Affected (11)

Products: Microsoft: Office, Office Compatibility Pack, Word

3 products

Office Compatibility Pack

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Microsoft Office	Version 2007 sp3
Microsoft Office	Version 2010 sp2
Microsoft Office	Version 2013 sp1
Microsoft Office	Version 2016
Microsoft Office	Version 2016
Microsoft Office Compatibility Pack	All versions
Microsoft Word	Version 2007 sp3
Microsoft Word	Version 2010 sp2
Microsoft Word	Version 2013 sp1
Microsoft Word	Version 2013 sp1
Microsoft Word	Version 2016

Related CWEs

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (15)

http://www.securityfocus.com/bid/102347

Source: secure@microsoft.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1040153

Source: secure@microsoft.com

Broken LinkThird Party AdvisoryVDB Entry

https://0patch.blogspot.com/2018/01/the-bug-that-killed-equation-editor-how.html

Source: secure@microsoft.com

ExploitThird Party Advisory

https://github.com/rxwx/CVE-2018-0802

Source: secure@microsoft.com

ExploitThird Party Advisory

https://github.com/zldww2011/CVE-2018-0802_POC

Source: secure@microsoft.com

Third Party Advisory

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0802

Source: secure@microsoft.com

PatchVendor Advisory

https://research.checkpoint.com/another-office-equation-rce-vulnerability/

Source: secure@microsoft.com

Exploit

http://www.securityfocus.com/bid/102347

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1040153

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkThird Party AdvisoryVDB Entry

https://0patch.blogspot.com/2018/01/the-bug-that-killed-equation-editor-how.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://github.com/rxwx/CVE-2018-0802

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://github.com/zldww2011/CVE-2018-0802_POC

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0802

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://research.checkpoint.com/another-office-equation-rce-vulnerability/

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0802

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

US Government Resource

Timeline

No history available yet.