Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Microsoft Office Equation Editor can run malicious code

CVE-2018-0862 · published 8 years ago
Summary

The Equation Editor component in Microsoft Office (2003, 2007, 2010, 2013, 2016) can be tricked into executing code from a remote attacker. This could let an attacker take control of the affected computer. Apply the latest security updates from Microsoft to fix the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
microsoft office 2007
2010
2013
2016
cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:*
microsoft office_compatibility_pack All versions
cpe:2.3:a:microsoft:office_compatibility_pack:-:sp3:*:*:*:*:*:*
microsoft word 2007
2010
2013
2016
cpe:2.3:a:microsoft:word:2007:sp3:*:*:*:*:*:*
Original advisory text
Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way ...
Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Word Remote Code Execution Vulnerability". This CVE is unique from CVE-2018-0805, CVE-2018-0806, and CVE-2018-0807.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.8 High
Exploitation
19% chance of attack within 30 days
Timeline
Published22 Jan 2018
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2018-0862 · NVD
Track software like this
Free during beta