CVE-2018-0802

What is Microsoft Office's Equation Editor?

Equation Editor (EQNEDT32.exe) is a legacy OLE component bundled with Microsoft Office to let users insert mathematical formulas into documents. It runs as a separate, decades-old 32-bit executable outside the main Office application's modern security hardening, which made its memory-safety bugs unusually easy for attackers to weaponize once discovered.

Overview

CVE-2018-0802 is a high-severity memory corruption vulnerability in Microsoft Office's Equation Editor component, distinct from but disclosed and patched alongside CVE-2018-0798 in the same January 2018 update. A specially crafted document containing a malformed embedded object can corrupt memory within Equation Editor when opened, leading to remote code execution in the context of the user who opened the file. Note this CVE's CVSS vector is scoped as a local attack vector (reflecting how the flaw is triggered through the local file-open/embedding mechanism) but is functionally delivered and exploited remotely via email attachments and downloaded documents, exactly like its sibling.

Technical Details

The flaw is classified under CWE-787 (out-of-bounds write): a stack-based buffer overflow in Equation Editor's handling of certain embedded object structures allows an attacker-crafted document to overwrite adjacent memory and hijack code execution. Because Equation Editor is invoked automatically when Office renders a document containing an equation object, no macro execution, security-warning bypass, or additional user action beyond opening the file is required.

Discovery

This vulnerability was patched by Microsoft in the same January 2018 Patch Tuesday release as CVE-2018-0798, arriving amid heightened scrutiny of Equation Editor following the widespread real-world exploitation of the earlier CVE-2017-11882 stack overflow throughout late 2017.

Exploitation Context

Like CVE-2018-0798, this bug was rapidly incorporated into commodity "Office exploit builder" kits circulating on criminal forums, making crafted malicious document generation accessible to a broad range of threat actors. These Equation Editor bugs collectively saw enormous real-world use in malspam campaigns delivering trojans, ransomware loaders, and remote-access tools, as well as in more targeted spearphishing operations. CISA's KEV catalog listing confirms this specific CVE has been used in real-world attacks.

Remediation

1. Apply the Microsoft January 2018 (or later cumulative) security update for the installed version of Office.
2. Consider disabling or removing the Equation Editor component (EQNEDT32.exe) if formula-editing functionality is not needed.
3. Deploy email attachment filtering/sandboxing capable of detecting malicious embedded OLE objects before attachments reach end users.
4. Enable Protected View for documents originating from the internet or untrusted sources.
5. Patch this CVE alongside CVE-2018-0798, since both affect the same component and were fixed in the same update.