CVE-2018-0804 is a remote code execution vulnerability affecting Microsoft Office versions 2003 through 2016, specifically within the Equation Editor component. This flaw arises from how objects are handled in memory, allowing an attacker to execute arbitrary code. With a CVSS score of 8.8 (HIGH), it presents a significant risk, requiring user interaction but offering high impact on confidentiality, integrity, and availability. While not listed in CISA KEV and lacking public exploit code in Metasploit or ExploitDB, its high EPSS score and media coverage suggest it was a notable threat at the time, though active exploitation is not currently indicated.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2007CPE matchmatch criteria | cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:* | ||
2010CPE matchmatch criteria | cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:* | ||
2013CPE matchmatch criteria | cpe:2.3:a:microsoft:office:2013:sp1:*:*:*:*:*:* | ||
2016CPE matchmatch criteria | cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:*:* | ||
2016CPE matchmatch criteria | cpe:2.3:a:microsoft:office:2016:*:*:*:click-to-run:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.