Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
HighCISA KEVExploited in the wildPublic exploit

Microsoft Office Equation Editor Memory Corruption RCE

IdentifiersCVE-2018-0798CWE-119

CVE-2018-0798 is a remote code execution vulnerability in Microsoft Office Equation Editor affecting Microsoft Office 2007, 2010, 2013, and 2016. The provided content states the flaw exists because of the way Equation Editor handles objects in memory, resulting in memory corruption. In observed exploitation, attackers embedded malicious content in Office documents, particularly RTF and other weaponized Office files, to trigger the vulnerable Equation Editor component (eqnedt32.exe) and execute attacker-controlled shellcode or payloads. The vulnerability is referred to by Microsoft as the "Microsoft Office Memory Corruption Vulnerability."

Share:
For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows remote code execution in the context of the user who opens the malicious Office document. The content shows this vulnerability being used extensively in phishing and espionage campaigns to launch shellcode, drop malware, install RATs and backdoors such as Cotx RAT, Bisonal, and ZxxZ, and enable follow-on compromise activities. Impact therefore includes full execution of attacker-supplied code, malware installation, persistence establishment, and subsequent espionage or broader host compromise.

Mitigation

If you can’t patch tonight, do this now.

Until patching is complete, reduce exposure by blocking or sandboxing inbound Office and RTF attachments from untrusted sources, disabling or restricting execution of Equation Editor/eqnedt32.exe where operationally feasible, and using Protected View, application control, and EDR detections for suspicious Office child-process behavior and Equation Editor execution. User awareness against spear-phishing attachments and mail gateway filtering for weaponized RTF/OLE content can further reduce exploitability.

Remediation

Patch, then assume compromise.

Apply Microsoft's security updates for CVE-2018-0798 to affected Microsoft Office 2007, 2010, 2013, and 2016 installations. Because the vulnerable component is Microsoft Equation Editor, organizations should ensure Office is updated to a version in which the flaw is corrected and remove or disable legacy Equation Editor components where Microsoft guidance or product updates have done so. Prioritize patching systems that open externally sourced Office and RTF documents.
PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType
Microsoft CorporationOfficeapplication
Microsoft CorporationOffice Compatibility Packapplication
Microsoft CorporationWordapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence16

Every observed campaign linking this CVE to a named adversary.

Associated malware10

Malware families riding this exploit, with evidence and IOCs.

Detection signatures1

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity2

Community discussion across Reddit, Mastodon, and other social sources.