CVE-2018-0802KEV · OVERDUE

Microsoft Office Memory Corruption Vulnerability

High · published January 10, 2018

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 99.8th percentile for exploit probability.

1633
days past CISA
deadline
CVSS v3.1
7.8
EPSS
93%
Percentile
99.8
In the wild
Confirmed
What it is

🚨 A crafty flaw in Microsoft Office's Equation Editor opens the door to remote code execution! If you thought math was harmless, think again! ⚡ Picture a waiter who takes your order but accidentally mixes up the ingredients, serving you a dish you didn’t ask for. This vulnerability allows attackers to manipulate memory objects in Office, like a chef who doesn’t check the recipe before cooking. 🍽️ An attacker could exploit this vulnerability to run arbitrary code on your system, potentially gaining full control. Imagine someone sneaking into your office and having the power to change documents, delete files, or even install malware—absolutely devastating! 🔥

Put simply

Picture a waiter who takes your order but accidentally mixes up the ingredients, serving you a dish you didn’t ask for. This vulnerability allows attackers to manipulate memory objects in Office, like a chef who doesn’t check the recipe before cooking. 🍽️ This vulnerability in Microsoft Office handles memory objects incorrectly, leading to potential remote code execution. It affects Office versions from 2007 through 2016, presenting a significant risk if left unaddressed.

What to do

An attacker could exploit this vulnerability to run arbitrary code on your system, potentially gaining full control. Imagine someone sneaking into your office and having the power to change documents, delete files, or even install malware—absolutely devastating! 🔥 To protect yourself, ensure that you update Microsoft Office to the latest version. Additionally, consider disabling the Equation Editor if it's not needed and regularly review your security settings to minimize exposure. 🛡️ You’re on the right track! Following these steps will help you secure your systems and keep those crafty attackers at bay! You've got this! 💪

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.93289 · 99.8th percentile
Published
2018-01-10T01:00Z
KEV added
2021-11-03 · due 2022-05-03
EPSS history
Timeline
  • 03 NOV 00:00Z
    Added to CISA KEV — remediate by May 3
    kev
  • 10 JAN 01:00Z
    Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulnerability…
    cvelistv5