cbcvebase.
CVE-2018-0806
published 2018-01-10

CVE-2018-0806: Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code…

PriorityP258high8.8CVSS 3.0
AVNACLPRNUIRSUCHIHAH
EPSS
24.58%
97.6th percentile
Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Word Remote Code Execution Vulnerability". This CVE is unique from CVE-2018-0804, CVE-2018-0805, and CVE-2018-0807.

Affected

21 ranges
VendorProductVersion rangeFixed in
microsoftoffice
microsoftoffice
microsoftoffice
microsoftoffice
microsoftword
microsoftword
microsoftword
microsoftword
microsoft_corporationequation_editor
msrcmicrosoft_office_2007_service_pack_3
msrcmicrosoft_office_2010_service_pack_2
msrcmicrosoft_office_2013_service_pack_1
msrcmicrosoft_office_2016
msrcmicrosoft_office_2016_click-to-run_for_32-bit_editions
msrcmicrosoft_office_2016_click-to-run_for_64-bit_editions
msrcmicrosoft_office_compatibility_pack_service_pack_3
msrcmicrosoft_word_2007_service_pack_3
msrcmicrosoft_word_2010_service_pack_2
msrcmicrosoft_word_2013_rt_service_pack_1
msrcmicrosoft_word_2013_service_pack_1
msrcmicrosoft_word_2016

Detection & IOCsextracted from sources · hover to see the quote

  • The vulnerability is triggered when a user opens a specially crafted file with an affected version of Microsoft Office or Microsoft WordPad; detection should focus on suspicious Office/WordPad documents that invoke Equation Editor (EQNEDT32.EXE)
  • Email-based delivery vector: monitor for Office/WordPad file attachments sent via email where the recipient is socially engineered to open the file
  • Web-based delivery vector: monitor for Office/WordPad file downloads from websites, including compromised sites hosting user-provided content
  • The fix removes Equation Editor functionality entirely; presence of EQNEDT32.EXE spawning child processes post-patch is a strong indicator of exploitation or patch non-compliance
  • ·CVE-2018-0806 is distinct from related Equation Editor RCE CVEs (CVE-2018-0805, CVE-2018-0807, CVE-2018-0849); ensure detections are scoped correctly and not conflated across these four CVEs
  • ·Impact is reduced for non-administrative users; privilege context of the victim user affects the blast radius of successful exploitation

CVSS provenance

nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vendor_msrc8.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.