Loading vulnerability…
A remote code execution vulnerability in Microsoft Office Equation Editor affecting Microsoft Office 2007, 2010, 2013, and 2016. The flaw resides in EQNEDT32.EXE and is caused by improper handling of objects in memory while processing crafted Equation Editor content embedded in Office documents. Available reporting consistently associates the issue with malformed Equation Editor data delivered through weaponized RTF, Word, or Excel documents, and multiple analyses place it among the additional Equation Editor flaws identified after scrutiny of the legacy component. Successful exploitation corrupts memory in the context of the Office application and can be used to execute attacker-controlled code when a victim opens a malicious document. The vulnerability is distinct from CVE-2018-0797 and CVE-2018-0812.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a proof-of-concept (PoC) exploit for CVE-2018-0802, a vulnerability in Microsoft Office's Equation Editor that allows for arbitrary code execution via a crafted RTF file. The repository contains three files: a README with usage instructions, a sample malicious RTF file ('cve-2018-0802.rtf'), and a Python script ('cve-2018-0802_poc.py') that generates malicious RTF files. The Python script takes an executable command (such as 'calc.exe' or a remote executable path) and outputs an RTF file that, when opened in a vulnerable version of Microsoft Word, will execute the specified command. The exploit leverages the embedding of an OLE object with a crafted Equation.3 object to trigger the vulnerability. The main attack vector is through a malicious file delivered to the victim, and the payload is customizable to execute arbitrary commands. The exploit is a PoC and does not include advanced features such as evasion or persistence.
This repository provides a proof-of-concept exploit for CVE-2018-0802 (and optionally CVE-2017-11882), both critical vulnerabilities in the Microsoft Office Equation Editor. The main exploit script, 'packager_exec_CVE-2018-0802.py', generates a malicious RTF file that embeds a user-supplied executable using a Packager OLE object. When the RTF is opened in a vulnerable version of Microsoft Office, the exploit drops the embedded executable to the %TMP% directory and executes it via a WinExec call, achieving arbitrary code execution. The script supports an option to exploit both CVE-2018-0802 and CVE-2017-11882 in a single document. The repository also includes a sample malicious RTF ('example/example.rtf') that launches calc.exe, YARA rules for detection of the exploit, and a utility script ('yara/strip_keycodes.py') for removing obfuscating keycodes from RTF files. The exploit is a POC and requires the attacker to supply the payload executable. The attack vector is via malicious file delivery (RTF), and the main fingerprintable endpoint is the dropped file in the %TMP% directory.
This repository contains a Python proof-of-concept exploit for the Microsoft Office Equation Editor vulnerabilities CVE-2017-11882 and CVE-2018-0802. The main file, RTF_11882_0802.py, is a command-line tool that generates a malicious RTF file. The user specifies a command to execute on the target system and the output file name for the crafted RTF. Optionally, a template RTF can be provided. The exploit works by embedding a specially crafted OLE object into the RTF, which triggers the vulnerability in the Equation Editor component when the file is opened in a vulnerable version of Microsoft Office on Windows. The exploit does not contain any hardcoded payload; instead, it allows the user to specify any command, making it a flexible proof-of-concept. The repository also includes a README with usage instructions and references to research and advisories. No network endpoints or external IPs/domains are present; the attack vector is via a malicious file delivered to the victim.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
80 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Microsoft Office memory corruption vulnerability referenced as an exploit used in Xworm delivery chains to stage payloads and evade endpoint defenses.
A Microsoft Office Equation Editor vulnerability actively exploited in July 2026 and described as abused by Cloud Atlas to deliver CloudAtlasGo.
A vulnerability in Microsoft Office documents exploited by Cloud Atlas for payload delivery of CloudAtlasGo.
A Microsoft Office Equation Editor memory corruption vulnerability cited as exploited by XWorm.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.