CVE-2018-0802

Microsoft Office’s Equation Editor is like a built-in “math handwriting/diagram” tool inside Word. This bug lets a malicious Office file trick the tool into mishandling data in memory, which can allow an attacker to run code on your computer when you open the file. In some real attacks, this has been used as an entry point for ransomware.

This matters if your business runs or edits documents with Microsoft Office versions/components that include the Equation Editor (including Microsoft Word 2007/2010/2013/2016, Microsoft Office 2016 Click-to-Run, Microsoft Office Compatibility Pack, and the Equation Editor component). The risk is primarily about whether an attacker can get a victim to open a malicious file that reaches the Equation Editor—no special login is required beyond user interaction (opening the file). Also, this has been used in the wild, so organizations that send/receive Office documents should treat it as an active threat.

RED—attackers are known to use this flaw in real ransomware campaigns, and it is listed in CISA’s Known Exploited Vulnerabilities catalog. A fix is available, and you should treat this as an urgent endpoint patching and document-handling risk.