CVE-2018-0798

Name of the Vulnerable Software and Affected Versions Microsoft Office 2007 Microsoft Office 2010 Microsoft Office 2013 Microsoft Office 2016 Microsoft Office Compatibility Pack (affected versions not specified) Microsoft WordPad (affected versions not specified)

Description A remote code execution issue exists in the Equation Editor of Microsoft Office and WordPad due to improper memory object handling, leading to a buffer overflow. An attacker can exploit this by inducing a user to open a specially crafted file, allowing the execution of arbitrary code within the context of the current user. If the user possesses administrative privileges, the attacker could gain full control of the system, enabling them to install software, modify or delete data, and create new accounts with full user rights. This issue has been exploited by multiple Chinese threat groups since late 2018.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.