CVE-2018-0802

Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE is unique from CVE-2018-0797 and CVE-2018-0812.

Exploited in the wild: Yesadded 2021-11-03 · due 2022-05-03 · known ransomware use. An observation, not a forecast.
EPSS · 30-day forecast: 93%Chance of exploitation in the next 30 days, 100th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD · HIGH: 7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Internet exposure: not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

not checked

Not checked yet. Our exploit watch has not looked at this CVE, so this says nothing either way.

On the wire

0 dispatches

No dispatch on our wire has named this CVE yet.

Cited as exploited by

APT40
1. “KRYPTONITE PANDA/APT40, a known contractor for MSS Hainan11 was found to have used high-value vulnerability CVE-2018-0802 as a 0day exploit”
  cited as exploiting · source: uscc.gov ↗ · 2026-10-17
2. “the use by KRYPTONITE PANDA of a high-value vulnerability (CVE-2018-0802), discovered by Chinese firm Qihoo 360, a month before it was publicly revealed.”
  cited as exploiting · source: crowdstrike.com ↗ · 2026-10-17
Tick
1. “BRONZE BUTLER has exploited Microsoft Office vulnerabilities CVE-2014-4114, CVE-2018-0802, and CVE-2018-0798 for execution.”
  cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17
APT23
1. “Here’s a summary of the attack chain of Tropic Trooper’s recent campaigns: Execute a command through exploits for CVE-2017-11882 or CVE-2018-0802 , security flaws in Microsoft Office’s Equation Editor (EQNEDT32.EXE).”
  cited as exploiting · source: blog.trendmicro.com ↗ · 2026-10-17
2. “Tropic Trooper has executed commands through Microsoft security vulnerabilities, including CVE-2017-11882, CVE-2018-0802, and CVE-2012-0158.”
  cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17
Confucius
1. “Confucius has exploited Microsoft Office vulnerabilities, including CVE-2015-1641, CVE-2017-11882, and CVE-2018-0802.”
  cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17
Tonto Team
1. “Tonto Team has exploited Microsoft vulnerabilities, including CVE-2018-0798, CVE-2018-8174, CVE-2018-0802, CVE-2017-11882, CVE-2019-9489 CVE-2020-8468, and CVE-2018-0798 to enable execution of their delivered malicious payloads.”
  cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17
Inception Framework
1. “Previously, Cloud Atlas dropped its “validator” implant named “PowerShower” directly, after exploiting the Microsoft Equation vulnerability (CVE-2017-11882) mixed with CVE-2018-0802.”
  cited as exploiting · source: securelist.com ↗ · 2026-10-17

Each actor is cited by the quoted source, linked under the quote. A citation is that source's claim, not our confirmation.

References

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on Telegram KEV RSS API

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.

Signals

Exploits

On the wire

Watch this one?