CVE-2018-0798

What is Microsoft Office's Equation Editor?

Equation Editor (EQNEDT32.exe) is a legacy Object Linking and Embedding (OLE) component bundled with Microsoft Office for decades to let users insert mathematical formulas into documents. It runs as a separate, aging 32-bit executable rather than being integrated into the main Office application code, and because it predates modern Office's security hardening (such as sandboxing and updated compiler mitigations), it became one of the most heavily targeted pieces of code in the entire Office ecosystem once its long-standing memory-safety issues were discovered.

Overview

CVE-2018-0798 is a high-severity memory corruption vulnerability in Microsoft Office's handling of embedded objects, affecting the Equation Editor component. A specially crafted document — typically a Word .doc/.rtf file — containing a malformed OLE object can corrupt memory when opened, leading to remote code execution in the context of the user who opened the file. Exploitation requires the victim to open a malicious document, but no further interaction beyond that.

Technical Details

The flaw is classified under CWE-787 (out-of-bounds write): a malformed embedded object causes Equation Editor to write past the bounds of an allocated buffer, corrupting adjacent memory in a way that an attacker can leverage to redirect code execution. This CVE was disclosed and patched at the same time as the closely related CVE-2018-0802, another Equation Editor memory corruption bug affecting a different code path within the same component; the two are frequently discussed together and were both quickly incorporated into the same malicious document builder toolkits.

Discovery

This vulnerability was patched by Microsoft as part of its January 2018 Patch Tuesday release, arriving in the same period as broader industry scrutiny of Equation Editor following the disclosure of CVE-2017-11882, an earlier Equation Editor stack overflow that had already been mass-exploited throughout late 2017.

Exploitation Context

Equation Editor RCE bugs from this era were exploited extremely widely because commodity "Office exploit builder" kits sold on criminal forums made it trivial for low-skill attackers to generate malicious .doc/.rtf attachments targeting these flaws, and because unlike macro-based malware, exploiting Equation Editor typically did not require the victim to enable macros or click through a security warning. These bugs were used in mass-scale malspam campaigns delivering a wide range of commodity malware, as well as by more targeted threat actors conducting spearphishing against government and business targets. CISA's KEV catalog listing confirms continued real-world exploitation of this specific CVE.

Remediation

1. Apply the Microsoft January 2018 (or later cumulative) security update for the installed version of Office.
2. Consider disabling or removing the Equation Editor component (EQNEDT32.exe) entirely if formula-editing functionality is not required, as Microsoft's own guidance for related Equation Editor CVEs recommended in some cases.
3. Deploy email attachment filtering/sandboxing to detect malicious OLE objects in incoming .doc/.rtf attachments before they reach end users.
4. Enable Protected View and disable automatic loading of embedded objects where organizational policy allows.
5. Educate users on the risk of opening unsolicited Office attachments, since exploitation here requires only opening the file, not enabling macros.