Microsoft Office Memory Corruption Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2021-11-03
• Known to be used in ransomware campaigns
• EPSS: 93% chance of exploitation in the next 30 days (higher than 100% of CVEs)

[ Description ]Official description

Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE is unique from CVE-2018-0797 and CVE-2018-0812.

CISA: Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0798.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 3 May 2022): Apply updates per vendor instructions.

• Patch on portal.msrc.microsoft.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ References ]References

• www.securityfocus.com/bid/102347Broken LinkThird Party AdvisoryVDB Entry
• www.securitytracker.com/id/1040153Broken LinkThird Party AdvisoryVDB Entry
• 0patch.blogspot.com/2018/01/the-bug-that-killed-equation-editor-how.htmlExploitThird Party Advisory
• github.com/rxwx/CVE-2018-0802ExploitThird Party Advisory
• github.com/zldww2011/CVE-2018-0802_POCThird Party Advisory
• portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0802PatchVendor Advisory
• research.checkpoint.com/another-office-equation-rce-vulnerabilityExploit
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource