CVE-2018-0798

Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Office Memory Corruption Vulnerability".

Exploited in the wild: Yesadded 2021-11-03 · due 2022-05-03. An observation, not a forecast.
EPSS · 30-day forecast: 95%Chance of exploitation in the next 30 days, 100th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD · HIGH: 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Internet exposure: not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

not checked

Not checked yet. Our exploit watch has not looked at this CVE, so this says nothing either way.

On the wire

0 dispatches

No dispatch on our wire has named this CVE yet.

Tied by cited sources to

TA428
1. “This RTF file contains malicious code for exploiting CVE-2018-0798 and an object called ‘8.t’. The inclusion of these objects suggests that it was created using the Royal Road RTF Weaponizer.”
  cited as used in a campaign · named nearby · source: vb2020.vblocalhost.com ↗ · 2026-10-17
2. “Attackers relied on Microsoft Equation Editor exploit CVE-2018-0798 to deliver a custom malware that Proofpoint researchers have dubbed Cotx RAT.”
  cited as exploiting · named nearby · source: proofpoint.com ↗ · 2026-10-17
Tick
1. “BRONZE BUTLER has exploited Microsoft Office vulnerabilities CVE-2014-4114, CVE-2018-0802, and CVE-2018-0798 for execution.”
  cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17
Tonto Team
1. “Tonto Team has exploited Microsoft vulnerabilities, including CVE-2018-0798, CVE-2018-8174, CVE-2018-0802, CVE-2017-11882, CVE-2019-9489 CVE-2020-8468, and CVE-2018-0798 to enable execution of their delivered malicious payloads.”
  cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17
Higaisa
1. “Higaisa has exploited CVE-2018-0798 for execution.”
  cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

Each actor is cited by the quoted source, linked under the quote. A citation is that source's claim, not our confirmation.

References

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on Telegram KEV RSS API

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.

Signals

Exploits

On the wire

Watch this one?