CVE-2018-0802

Microsoft Office’s Equation Editor is like a built-in “math handwriting/diagram” tool inside Word. This bug lets a malicious Office file trick the tool into mishandling data in memory, which can allow an attacker to run code on your computer when you open the file. In some real attacks, this has been used as an entry point for ransomware.

This matters if your business runs or edits documents with Microsoft Office versions/components that include the Equation Editor (including Microsoft Word 2007/2010/2013/2016, Microsoft Office 2016 Click-to-Run, Microsoft Office Compatibility Pack, and the Equation Editor component). The risk is primarily about whether an attacker can get a victim to open a malicious file that reaches the Equation Editor—no special login is required beyond user interaction (opening the file). Also, this has been used in the wild, so organizations that send/receive Office documents should treat it as an active threat.

RED—attackers are known to use this flaw in real ransomware campaigns, and it is listed in CISA’s Known Exploited Vulnerabilities catalog. A fix is available, and you should treat this as an urgent endpoint patching and document-handling risk.

1. Confirm exposure on endpoints
   • Inventory machines that use Microsoft Office/Word and check for the listed affected versions/components: Microsoft Word 2007 Service Pack 3, Microsoft Word 2010 Service Pack 2, Microsoft Word 2013 Service Pack 1, Microsoft Word 2013 RT Service Pack 1, Microsoft Word 2016, Microsoft Office 2016 Click-to-Run (C2R), Microsoft Office Compatibility Pack Service Pack 3, and “Equation Editor” where applicable.
   • If you run a mix of Office installations, handle each installation type separately (traditional MSI vs Click-to-Run C2R).
2. Apply the vendor fix
   • Follow Microsoft’s CVE-2018-0802 security guidance and apply the relevant updates to bring Office/Equation Editor to the vendor-fixed state.
   • After patching, re-check the Office build/patch level per the vendor instructions to ensure the fix is actually installed.
3. If patching must be delayed
   • Reduce exposure by restricting who can open email attachments and by treating unexpected Office documents as high-risk.
   • Use your organization’s existing email/web filtering controls to block or quarantine suspicious Office files.
   • Ensure end users understand not to open unexpected document attachments and to report them to IT.
4. What to monitor
   • Watch for alerts related to Office Equation Editor activity, suspicious process launches from Office, and any ransomware-related indicators on endpoints.
   • Confirm whether any endpoint opened suspicious Office documents around the same time as security events.
5. CISA due date context
   • CISA KEV remediation due date was 2022-05-03; since this is already overdue, prioritize all affected endpoints immediately.

CVE-2018-0802 is a memory corruption issue (CWE-787) in the Microsoft Office Equation Editor. The practical mechanism is that a crafted Office document can corrupt memory during object handling inside the Equation Editor, leading to remote code execution when a user opens the file (user interaction required). This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog and is associated with ransomware campaigns, making exploitation in the wild a confirmed reality. Public proof-of-concept material exists, indicating attackers can reproduce the technique. KEV status means defenders should assume active abuse and focus on patching the affected Office/Equation Editor installations rather than waiting for further confirmation.