{"id":"CVE-2018-0798","kind":"vulnerability","aliases":["CVE-2018-0798"],"related":[],"title":"Microsoft Office: Microsoft Office Memory Corruption Vulnerability","description":"Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0802.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Microsoft Office has a memory corruption flaw in how it handles objects in memory. An attacker who gets a crafted file opened can run code as the current user, and it is known to be exploited in the wild and chained with CVE-2018-0802.","severity":"critical","cvss":9.3,"epss":0.95121,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Microsoft Office","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","microsoft-office","windows"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the Microsoft Office security updates per vendor instructions (CISA required action); the specific patched build is unknown from the sources.","status":"open","published_at":"2018-01-10T01:29:00+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:37:15+00:00","updated_at":"2026-10-23T21:57:34+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:37:15Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft Office security updates per vendor instructions (CISA required action); the specific patched build is unknown from the sources.","reach":"internet","impact":"high","summary":"Microsoft Office has a memory corruption flaw in how it handles objects in memory. An attacker who gets a crafted file opened can run code as the current user, and it is known to be exploited in the wild and chained with CVE-2018-0802.","category":"infrastructure","who_cares":["microsoft-office","windows"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs code as the logged-in user after a crafted document is opened","analyst_note":"Find the patched Office build numbers and a detection method from Microsoft's security update guide for CVE-2018-0798 (msrc.microsoft.com).","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00046,"input_tokens":2853,"output_tokens":349,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Find the patched Office build numbers and a detection method from Microsoft's security update guide for CVE-2018-0798 (msrc.microsoft.com).","search":"'-0798':10A,13A '-0802':66B,107C '-2018':9A,12A,65B,106C 'action':110C 'allow':85C 'appli':111C 'attack':37B 'chain':62B,103C 'cisa':108C 'code':46B,88C 'contain':69C 'context':92C 'corrupt':6A,27B,72C 'craft':41B 'current':49B,95C 'cve':8A,11A,64B,105C 'due':74C 'execut':89C 'exploit':16B,57B,84C 'file':42B 'flaw':28B 'get':39B 'handl':32B,80C 'infrastructur':17B 'instruct':115C 'known':54B,100C 'memori':5A,26B,35B,71C,82C 'microsoft':1A,3A,14A,19B,22B,67C 'microsoft-offic':18B 'object':33B,78C 'offic':2A,4A,20B,23B,68C 'office':15A 'open':43B 'per':113C 'remot':87C 'requir':109C 'run':45B 'success':83C 'updat':112C 'user':50B,96C 'vendor':114C 'vulner':7A,73C,98C 'way':77C 'wild':60B 'window':21B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2018-01-10T01:29:00+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2018-0798","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-0798","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T17:39:59+00:00","note":null},{"source":"epss","external_id":"CVE-2018-0798","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-0798","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2018-0798","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-0798","severity":null,"published_at":"2018-01-10T01:29:00+00:00","modified_at":"2026-06-17T01:31:40+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T21:57:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}