Microsoft · Office
A memory corruption flaw in the Equation Editor component of Microsoft Office 2007, 2010, 2013 and 2016 is caused by how objects are handled in memory, leading to an out-of-bounds write. An attacker who can get a user to open a crafted document, with user interaction required and no prior authentication needed, could execute arbitrary code, and the attack vector is recorded as local.
Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE is unique from CVE-2018-0797 and CVE-2018-0812.
First seen exploited 1 day before it was disclosed. Public exploit code (PoC-in-GitHub) appeared 1 day after disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
Memory corruption yields code execution in client application; AnnoCTR expert entity-linking label (train split); ATT&CK ID T1203 written in the same sentence as CVE-2018-0802
allow a remote code execution vulnerability due to the way objects are handled in memory
ATT&CK Techniques Tactic Technique ID Description Initial Access Spearphishing Attachment T1193 Used to deliver first stage malware Supply Chain Compromise T1195 Used for initial intrusion on subsidiaries Execution Exploitation for Client Execution T1203 Used to exploit CVE-2018-0802 and
**VenomKit.** VenomKit is a tool that threat actors can use to craft malicious Rich Text File (RTF) documents that exploit multiple vulnerabilities, including CVE-2017–11882, CVE-2018–0802, and CVE-2018–8174.
Victim opens malicious Office document (UI:R)
Equation Editor in Microsoft Office 2007, Microsoft Office 2010
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2018-0802 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
…the Equation Editor application is automatically launched to run the embedded objects containing the shellcode to exploit known vulnerabilities described by CVE-2017-11882, CVE-2018-0798 and CVE-2018-0802 — all in Microsoft Office — then downloads the trojan from the hosting server and runs it on the victim's…
2 passages name itOriginal (opens in a new tab) ↗
**VenomKit.** VenomKit is a tool that threat actors can use to craft malicious Rich Text File (RTF) documents that exploit multiple vulnerabilities, including CVE-2017–11882, CVE-2018–0802, and CVE-2018–8174.
RoyalRoad leverages a specific set of vulnerabilities, including CVE-2018-0802, CVE-2018-0798, and CVE-2017-11882, within the Equation Editor of Microsoft Office.
Previously, Cloud Atlas dropped its “validator” implant named “PowerShower” directly, after exploiting the Microsoft Equation vulnerability (CVE-2017-11882) mixed with CVE-2018-0802.
…utable Executable HTML Scheduled Task BITS Jobs Threadkit BlackTDS LCG Kit CVE-2014-0515 CVE-2017-11882 Java Password Protected CAPTCHA CVE-2018-8174 Compiled HTML File Autolt HTAPackager Shell Object IP FilteringCertutil CVE-2017-8570 Application Access Token Shortcut Fallout Exploit Kit CVE-2018-0802…
2 passages name itOriginal (opens in a new tab) ↗
ATT&CK Techniques Tactic Technique ID Description Initial Access Spearphishing Attachment T1193 Used to deliver first stage malware Supply Chain Compromise T1195 Used for initial intrusion on subsidiaries Execution Exploitation for Client Execution T1203 Used to exploit CVE-2018-0802 and…
3 passages name itOriginal (opens in a new tab) ↗
Mentions the CVE; no further detail.
Mentions the CVE; no further detail.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.