{"id":"CVE-2018-0802","kind":"vulnerability","aliases":["CVE-2018-0802"],"related":[],"title":"Microsoft Office: Microsoft Office Memory Corruption Vulnerability","description":"Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0798.\n\nCISA required action: Apply updates per vendor instructions.","summary":"A memory corruption flaw in Microsoft Office lets a crafted document run code in the context of the current user. It is known to be exploited in the wild and chained with CVE-2018-0798.","severity":"critical","cvss":9.3,"epss":0.93289,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Microsoft Office","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","microsoft-office","package","ransomware","windows"],"not_affected_if":["unpatched-only-if-updated"],"how_to_check":null,"fix":"Apply the Microsoft updates for Office per vendor instructions, as CISA required.","status":"open","published_at":"2018-01-10T01:29:00+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:37:21+00:00","updated_at":"2026-10-23T21:57:34+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T21:37:21Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft updates for Office per vendor instructions, as CISA required.","reach":"internet","impact":"high","summary":"A memory corruption flaw in Microsoft Office lets a crafted document run code in the context of the current user. It is known to be exploited in the wild and chained with CVE-2018-0798.","category":"package","who_cares":["microsoft-office","windows"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs code as the logged-in user after the victim opens a document.","analyst_note":"Sources do not list affected or fixed Office versions; check the Microsoft security update guide entry for CVE-2018-0802 to fill how_to_check and fix.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unpatched-only-if-updated"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000447,"input_tokens":2858,"output_tokens":323,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Sources do not list affected or fixed Office versions; check the Microsoft security update guide entry for CVE-2018-0802 to fill how_to_check and fix.","search":"'-0798':57B,98C '-0802':10A,13A '-2018':9A,12A,56B,97C 'action':101C 'allow':76C 'appli':102C 'chain':53B,94C 'cisa':99C 'code':35B,79C 'contain':60C 'context':38B,83C 'corrupt':6A,25B,63C 'craft':32B 'current':41B,86C 'cve':8A,11A,55B,96C 'document':33B 'due':65C 'execut':80C 'exploit':16B,48B,75C 'flaw':26B 'handl':71C 'instruct':106C 'known':45B,91C 'let':30B 'memori':5A,24B,62C,73C 'microsoft':1A,3A,14A,18B,28B,58C 'microsoft-offic':17B 'object':69C 'offic':2A,4A,19B,29B,59C 'office':15A 'packag':20B 'per':104C 'ransomwar':21B 'remot':78C 'requir':100C 'run':34B 'success':74C 'updat':103C 'user':42B,87C 'vendor':105C 'vulner':7A,64C,89C 'way':68C 'wild':51B 'window':22B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2018-01-10T01:29:00+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2018-0802","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-0802","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T14:39:41+00:00","note":null},{"source":"epss","external_id":"CVE-2018-0802","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-0802","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2018-0802","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-0802","severity":null,"published_at":"2018-01-10T01:29:00+00:00","modified_at":"2026-06-17T01:31:41+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T21:57:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}