Technical intelligence and weaponization dossier for CVE-2018-0802. Documented exploitation across 6 active malware families totaling 5,233 analyzed telemetry samples.
| Vulnerability ID | CVE-2018-0802 |
|---|---|
| Common Name / Bulletin | Microsoft Office Equation Editor Memory Corruption Vulnerability (Microsoft Patch Tuesday) |
| CWE Classification | CWE-119: Memory Corruption in EQNEDT32.EXE |
| Affected Software & Versions | Microsoft Office 2007, 2010, 2013, 2016 |
| Technical Root Cause | Secondary buffer overflow in Equation Editor font parsing routine bypassing incomplete CVE-2017-11882 patches, leading Microsoft to ultimately remove the executable entirely. |
| Associated ATT&CK Techniques |
Empirical catalog telemetry verifies that the following 6 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:
| Malware Family | Category | Catalog Samples | Operational Profile |
|---|---|---|---|
| razy | Infostealer | 3,391 | Razy (cataloged across cybersecurity research as Trojan:Win32/Razy, Trojan.Win32.Razy, and Trojan.Razy.gen) is a sophisticated Windows trojan and information st... |
| azorult | Infostealer | 1,513 | AZORult is an infamous, highly efficient commodity information stealer and malware downloader first commercialized in 2016 by Russian underground developer 'Pav... |
| socelars | Infostealer | 159 | Trojan:Win32/Socelars is a targeted browser session hijacking and credential theft trojan that surfaced in 2019, specifically engineered to compromise corporate... |
| netwiredrc | Rat | 72 | Trojan:Win32/Netwire (cataloged as NetWiredRC, or simply NetWire) is an infamous cross-platform Remote Access Trojan (RAT) and infostealer that was commercially... |
| lokibot | Infostealer | 55 | LokiBot (also designated as Loki PWS) is a widely proliferated commodity information stealer and keylogger first observed in 2015. Authored by an underground de... |
| agenttesla | Infostealer | 43 | Agent Tesla is an accessible, highly ubiquitous commercial info-stealer and keylogger built on the Microsoft .NET framework. First surfacing in late 2014, the t... |
Threat intelligence confirms the following adversaries weaponize CVE-2018-0802 in enterprise intrusions and campaign toolkits:
Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2018-0802 in enterprise networks:
Execution of eqnedt32.exe on endpoints where Equation Editor should be deprecated; suspicious child processes spawning from Equation Editor.SOC containment checklist and attack surface reduction measures to neutralize exploitation:
For end-to-end incident response procedures, consult our dedicated playbook: InfoStealer Protection & Remediation →