Microsoft · Office
CVE-2018-0802
Microsoft Office Memory Corruption Vulnerability
무엇인가
Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE is unique from CVE-2018-0797 and CVE-2018-0812.
CISA: Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0798.
할 일
Apply updates per vendor instructions.
미국 연방 기관 조치 기한: 2022년 5월 3일
- CISA 목록에 추가됨
- 2021년 11월 3일
- 게시됨
- 2018년 1월 10일
- 심각도
- 높음 7.8 CVSS 3.1
- 향후 30일 내 공격 가능성(EPSS)
- 93% 알려진 모든 취약점 중 상위 0.2%
- 약점 유형
- CWE-787
- 자세히
- NVD · CVE.org · CISA
모든 참고 자료(7)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0802
- https://github.com/rxwx/CVE-2018-0802
- http://www.securitytracker.com/id/1040153
- https://0patch.blogspot.com/2018/01/the-bug-that-killed-equation-editor-how.html
- http://www.securityfocus.com/bid/102347
- https://github.com/zldww2011/CVE-2018-0802_POC
- https://research.checkpoint.com/another-office-equation-rce-vulnerability/
Microsoft의 다른 악용된 결함
| 추가됨 | 취약점 | 제품 | 심각도 | 공격 가능성 |
|---|---|---|---|---|
| 2026. 4. 14. | Remote Code Execution | Office | 높음 8.8 | 43% |
| 2026. 2. 10. | Word Reliance on Untrusted Inputs in a Security Decision | Office | 높음 7.8 | 1.6% |
| 2026. 1. 26. | Security Feature Bypass | Office | 높음 7.8 | 71% |
| 2026. 1. 7. | PowerPoint Code Injection | Office | 높음 8.8 | 67% |
| 2025. 8. 12. | Excel Remote Code Execution | Office | 높음 8.8 | 43% |
| 2023. 3. 14. | Outlook Privilege Escalation | Office | 치명적 9.8 | 97% |
| 2023. 2. 14. | Publisher Security Feature Bypass | Office | 높음 7.3 | 12% |
| 2022. 6. 8. | Object Record Corruption | Office | 높음 7.8 | 53% |
출처: Known Exploited Vulnerabilities(CISA, 퍼블릭 도메인), CVE records(cve.org), EPSS(FIRST). 공격 가능성은 누군가 향후 30일 안에 이 결함을 악용하려 할 확률에 대한 EPSS 추정치입니다.