Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
CISA KEV·Added 2021-11-03 — agencies required to remediate by 2022-05-03

CVE-2018-0798

HIGH

Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects…

Published
Jan 10, 2018
Updated
Oct 28, 2025
Affected
0 pkgs
Patched
None yet
Exploits
1 known

EPSS Exploitation Probability

via FIRST.org ↗
94.1%probability of exploitation in next 30 days
Very High Risk100th percentile0.00%
93.5%93.9%94.2%94.6%94.1%94.1%Dec 25Apr 26Jun 26

EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.

Description

Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Office Memory Corruption Vulnerability".

Affected Products

3 products · 11 configurations
Application
officemicrosoft
4 versions
2007201020132016
Application
office compatibility packmicrosoft
all
Application
wordmicrosoft
4 versions
2007201020132016
Exploits & PoCs
1

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

Frequently Asked Questions

Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Office Memory Corruption Vulnerability".
O3 Security · Impact-Aware SCA

Is CVE-2018-0798 in your stack?

O3 detects CVE-2018-0798 across dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.