CVE-2018-0798

Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Office Memory Corruption Vulnerability".

Affected

Microsoft Corporation · Equation Editor

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS

95.12% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2021-11-03

Published

2018-01-10

Updated

2025-10-21

Proof-of-concept exploits (1)

• Sunqiz/CVE-2018-0798-reproduction0★ · 2022-08-30

Security advisories

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0798
• http://www.securityfocus.com/bid/102370
• http://www.securitytracker.com/id/1040153
• https://0patch.blogspot.com/2018/01/bringing-abandoned-equation-editor-back.html

References

• CVE Record
• NVD entry

Related

• CVE-2010-2553
• CVE-2010-3333
• CVE-2011-0104
• CVE-2012-0158
• CVE-2013-2028
• CVE-2017-0199